Function at 0x474e43
Capabilities:
Get common file path
Start service

Disassembly:
mov eax, 0x4ca20b
call fcn.004c9590
sub esp, 0x258
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x4c], ecx
xor edi, edi
inc edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0x2304b25b
xor ebx, ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x30], ebx
je 0x474e7e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
jmp 0x474e93
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], al
je 0x474e93
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [0xacb6c0]
test al, 1
jne 0x474eb3
or eax, edi
mov dword [0xacb6c0], eax
call fcn.004765f6
push 0x4ca915
call fcn.004b408d
pop ecx
movdqa xmm0, xmmword [0xabe780]
movdqu xmmword [ebp - 0x210], xmm0
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
lea ecx, [ebp - 0x84]
call fcn.00452a91
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x14], ebx
jmp 0x474f17
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x21c], 0xeac8b13e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x474f06
mov dword [ebp - 0x14], ebx
push 2
pop esi
jmp 0x474f36
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0], 0x57736d0c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x474f25
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x24], eax
mov dword [eax + 4], ebx
push edi
lea ecx, [ebp - 0xd8]
call fcn.00450d2f
push 3
lea ecx, [ebp - 0x124]
call fcn.00450d2f
mov dword [ebp - 0x14], ebx
jmp 0x474f78
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xc9ca3191
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x474f65
mov dword [ebp - 0x14], ebx
jmp 0x474f92
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x474f82
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x474fb7
push 0x1dd7
push 0x2135
push ebx
push 0x264b
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
cmp dword [ebp - 0x34], ebx
je 0x474ff2
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 4]
mov dword [ebp + eax*4 - 0x21c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe0], edi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x4750c4
push 0x1eaf
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x4750c4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
jmp 0x47500b
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1bc], 0xf51b4373
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x474ffa
mov eax, dword [ebp - 0xd8]
cmp dword [eax], ebx
jne 0x475058
mov eax, dword [eax]
cmp dword [ebp - 0xe0], eax
jge 0x47502a
test eax, eax
mov edx, ebx
je 0x47502c
mov edx, edi
xor eax, eax
mov ecx, dword [ebp - 0x24]
cmp edx, dword [ecx + 4]
setge al
cmp eax, 0xf0aeacb2
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setge dl
mov eax, dword [ebp - 0xd8]
mov dword [eax], edx
test edx, edx
mov dword [ebp - 0x3c], ebx
je 0x47505b
mov dword [ebp - 0x3c], edi
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x84]
cmp ecx, dword [eax]
setle dl
xor eax, eax
cmp edx, 0x514f
setne al
imul eax, dword [ebp - 0x3c]
push 7
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
xor ecx, ecx
cmp eax, 0x5ee87909
setle cl
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, dword [edx + 4]
setl cl
mov dword [ebp - 0x1bc], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x4750c4
push ebx
push 0x20b8
push 0x613
push 0x20a7
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
lea ecx, [ebp - 0x124]
call fcn.00450e01
lea ecx, [ebp - 0xd8]
call fcn.00450e01
mov eax, dword [ebp - 0x24]
inc dword [eax + 4]
cmp dword [eax + 4], esi
jle 0x474f47
lea ecx, [ebp - 0x84]
call fcn.00450e01
imul eax, dword [ebp - 0x4c], 0x2710
add eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x2c], 0x549e
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], 0x85ba5616
mov dword [ebp - 0x38], 0x75d1
cmp dword [ebp - 0x38], 0x794d
jle 0x4751a4
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 0x3c], ebx
mov edx, ebx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], 0x7f70
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, edx
sar eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0x248]
call fcn.00401993
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x475166
mov eax, dword [eax]
push eax
call fcn.004b40b7
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x248]
call fcn.0045110b
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x4926
mov edx, dword [ebp - 0x30]
jl 0x47514a
mov eax, dword [ebp - 0x3c]
add edx, eax
mov dword [ebp - 0x30], edx
dec dword [ebp - 0x34]
jne 0x475145
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x5582
jl 0x475139
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x38], 0x729e
jge 0x4751c2
push str.qwculfbf_fkgrphski_dcatn_qnkreo_jaiid_atp
call fcn.004b40b7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x4751ee
mov dword [ebp - 0x40], ebx
jmp 0x475204
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x228], 0xffffffff
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
jl 0x4751f3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, edi
sub ecx, eax
je 0x475232
cmp dword [ebp - 0x1c], ebx
mov edx, edi
jne 0x475234
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
setge dl
mov dword [ebp - 0x228], edx
neg edx
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
xor eax, eax
cmp edx, 0x2c0d
setg al
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x30], ecx
lea eax, [ebp - 0x5c]
push eax
call fcn.0047663f
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], 6
push edi
lea ecx, [ebp - 0xa0]
call fcn.00450d2f
mov dword [ebp - 0x50], 0x4caa8e55
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x2c], 0xbe92e3f9
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x38], 0x3de467b4
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xedb6b7be
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0x870b1b9b
mov dword [ebp - 0x20], ebx
jmp 0x4752f0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0x2a1836cc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x4752dd
mov dword [ebp - 0x14], ebx
jmp 0x475335
push esi
lea ecx, [ebp - 0x184]
call fcn.00450d2f
mov dword [ebp - 0x20], ebx
jmp 0x47531a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x47530b
mov eax, dword [ebp - 0x184]
inc dword [eax]
lea ecx, [ebp - 0x184]
call fcn.00450e01
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
je 0x4752fa
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x4754e9
push 3
lea ecx, [ebp - 0x16c]
call fcn.00450d2f
mov dword [ebp - 0x28], 0xc9995890
mov dword [ebp - 0x28], 0x8939f5fa
mov dword [ebp - 0x28], 0xe6b6cd3
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x28], 0xee56e31b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x28], 0xffffffff
push 4
lea ecx, [ebp - 0x13c]
call fcn.00450d2f
mov dword [ebp - 0x1c], ebx
jmp 0x4753b0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x83066c93
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x47539d
mov dword [ebp - 0x1c], ebx
jmp 0x4753ce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x4753bb
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x28], eax
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
jmp 0x475402
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa4], 0xaa61fc2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x4753f1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edi
setle cl
sub ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x2c]
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0xa0]
add edx, dword [eax + esi*4]
jne 0x47544d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa0]
cmp dword [eax + ecx*4], ebx
mov edx, ebx
je 0x47544f
mov edx, edi
dec dword [ebp - 0x30]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0xa4], esi
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x54]
sub edx, dword [eax + 4]
mov ecx, dword [ebp - 0x50]
add ecx, esi
add ecx, edx
xor edx, edx
mov eax, dword [ebp - 0xa0]
cmp dword [eax + edi*4], ecx
sete dl
add edx, 7
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x28]
inc dword [eax + 4]
cmp dword [eax + 4], 0
push 1
pop edi
jle 0x4753e9
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x4754c4
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_ExtCreatePen]
lea ecx, [ebp - 0x13c]
call fcn.00450e01
lea ecx, [ebp - 0x16c]
call fcn.00450e01
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
push 1
pop edi
jle 0x475347
lea ecx, [ebp - 0xa0]
call fcn.00450e01
push 2
pop esi
push esi
cmp dword [ebp - 0x40], 0
je 0x47563f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], 0xfa147b80
lea ecx, [ebp - 0x10c]
call fcn.00450d2f
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], ebx
jmp 0x475532
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x47551f
mov dword [ebp - 0x1c], ebx
jmp 0x475549
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1f0], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x47553c
cmp dword [ebp - 0x14], ebx
je 0x47557c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10c]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
imul eax, eax, 0x4142
sub eax, 0x4bba03a
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, 3
setne cl
mov dword [ebp - 0x1f0], ecx
mov dword [ebp - 0x20], ebx
jmp 0x4755af
mov dword [ebp - 0x14], ebx
jmp 0x4755a6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
jne 0x4755e1
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jle 0x47559a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
jg 0x475595
lea ecx, [ebp - 0x10c]
call fcn.00450e01
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xcc], eax
push edi
lea ecx, [ebp - 0xf4]
call fcn.00450d2f
mov dword [ebp - 0x28], 0xb999fb0
mov dword [ebp - 0x40], ebx
jmp 0x4755fb
push ebx
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 0xfb63
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], edi
jl 0x4755e8
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
add eax, 0x45cd
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x47562f
push ebx
push 0x163f
push 0xa88
push 0xa70
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
lea ecx, [ebp - 0xf4]
call fcn.00450e01
jmp 0x4765d7
lea ecx, [ebp - 0x1e8]
call fcn.00450d2f
mov dword [ebp - 0x1c], ebx
jmp 0x475659
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x48], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x47564f
mov dword [ebp - 0x1c], ebx
jmp 0x475676
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1e8]
mov dword [eax + ecx*4], 0x405b4019
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x475663
mov dword [ebp - 0x48], ebx
jmp 0x475742
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xfffffffc
jmp 0x475735
mov dword [ebp - 0x2c], 0x822e6e7f
mov dword [ebp - 0x1c], ebx
jmp 0x4756af
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x47569e
mov dword [ebp - 0x1c], ebx
jmp 0x4756ca
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x198], 0x55a6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4756b9
mov dword [ebp - 0x2c], ebx
jmp 0x47572d
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x28], 0xe26595ad
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x3c], ebx
jl 0x47572a
push edi
lea ecx, [ebp - 0x118]
call fcn.00450d2f
mov dword [ebp - 0x20], ebx
jmp 0x475707
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x118]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x4756f7
mov ecx, dword [ebp - 0x198]
mov eax, dword [ebp - 0x118]
mov dword [eax], ecx
lea ecx, [ebp - 0x118]
call fcn.00450e01
dec dword [ebp - 0x3c]
jns 0x4756e6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x4756d4
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffee
jge 0x475692
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xffffffe4
jge 0x475683
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1e8]
call fcn.00450e01
mov eax, dword [0xacb6c0]
test al, 2
jne 0x4757e1
or eax, esi
mov dword [0xacb6c0], eax
mov dword [0xacb6a0], ebx
mov dword [0xacb6a4], ebx
push ebx
push ebx
call fcn.0045ee33
mov dword [0xacb6a0], eax
mov dword [0xacb6a8], ebx
mov dword [0xacb6b0], ebx
mov dword [0xacb6bc], 0x3f800000
mov dword [ebp - 0xb4], eax
mov dword [0xacb6ac], ebx
lea eax, [ebp - 0xb4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1dc]
push eax
mov ecx, 0xacb6a8
call fcn.0045eb69
mov dword [0xacb6b4], 7
mov dword [0xacb6b8], 8
push 0x4ca910
call fcn.004b408d
pop ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x67f5ed9a
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0xc80fc3a0
mov dword [ebp - 0x28], 0x4f823aaf
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
jmp 0x47581d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x254], 0xfebfb2c4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x47580c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffb5f3
setge al
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x24]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x14], 6
push edi
lea ecx, [ebp - 0xb0]
call fcn.00450d2f
mov dword [ebp - 0x38], 0x4caa8e55
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x54], 0xbe92e3f9
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x50], 0x3de467b4
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], 0xedb6b7be
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x870b1b9b
mov dword [ebp - 0x20], ebx
jmp 0x4758cd
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0x2a1836cc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x4758ba
mov dword [ebp - 0x14], ebx
jmp 0x475912
push esi
lea ecx, [ebp - 0x130]
call fcn.00450d2f
mov dword [ebp - 0x20], ebx
jmp 0x4758f7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x4758e8
mov eax, dword [ebp - 0x130]
inc dword [eax]
lea ecx, [ebp - 0x130]
call fcn.00450e01
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
je 0x4758d7
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x475ac6
push 3
lea ecx, [ebp - 0x160]
call fcn.00450d2f
mov dword [ebp - 0x44], 0xc9995890
mov dword [ebp - 0x44], 0x8939f5fa
mov dword [ebp - 0x44], 0xe6b6cd3
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], 0xee56e31b
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], 0xffffffff
push 4
pop esi
push esi
lea ecx, [ebp - 0x148]
call fcn.00450d2f
mov dword [ebp - 0x1c], ebx
jmp 0x47598f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0x83066c93
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x47597c
mov dword [ebp - 0x1c], ebx
jmp 0x4759a9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x47599a
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x1c], eax
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x20], ebx
jmp 0x4759dc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x94], 0xaa61fc2d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x4759cb
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edi
setle cl
sub ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x54]
neg edx
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0xb0]
add edx, dword [eax + esi*4]
jne 0x475a27
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb0]
cmp dword [eax + ecx*4], ebx
mov edx, ebx
je 0x475a29
mov edx, edi
dec dword [ebp - 0x30]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x94], esi
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
sete cl
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ebp - 0x3c]
sub edx, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
add ecx, esi
add ecx, edx
xor edx, edx
mov eax, dword [ebp - 0xb0]
cmp dword [eax + edi*4], ecx
sete dl
add edx, 7
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x1c]
inc dword [eax + 4]
cmp dword [eax + 4], 0
push 1
pop edi
jle 0x4759c3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x475a9e
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_ExtCreatePen]
lea ecx, [ebp - 0x148]
call fcn.00450e01
lea ecx, [ebp - 0x160]
call fcn.00450e01
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
push 1
pop edi
jle 0x475924
push 2
pop esi
lea ecx, [ebp - 0xb0]
call fcn.00450e01
lea eax, [ebp - 0x4c]
push eax
call fcn.004766a1
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], eax
cmp byte [ebp + 0xc], 0
jne 0x475af0
test eax, eax
jne 0x475ef9
mov dword [ebp - 0x20], ebx
movdqa xmm0, xmmword [0xabe770]
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x200]
push eax
push ebx
lea ecx, [ebp - 0x90]
call fcn.00452a91
mov dword [ebp - 0x2c], 0x88586fd5
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x20]
cmp dword [ecx + 8], eax
jle 0x475c1a
mov dword [ebp - 0x24], 0x1373
cmp dword [ebp - 0x24], 0x1746
jle 0x475ba0
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov eax, edi
mov ecx, ebx
shl eax, cl
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
inc ebx
cmp ebx, 0x5a41
jl 0x475b75
inc edi
cmp edi, 0x7fec
push 0
pop ebx
jl 0x475b72
xor edi, edi
inc edi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x475bbe
push 0x398
push 0x3e6
push 0x196e
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x1259
jge 0x475bd9
mov edx, str.wtvzxrpn_ohx_qdluvmbo_ylqa
mov ecx, 0xaca3b8
call fcn.004525c0
or dword [ebp - 4], 0xffffffff
jmp 0x475c08
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x475c29
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x475c29
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x475c29
call dword [sym.imp.USER32.dll_EndMenu]
mov dword [ebp - 0x2c], 0xfffffff9
jmp 0x475cf8
mov dword [ebp - 0x38], 0x24f63abe
mov dword [ebp - 0x24], 0x5b01d976
push edi
lea ecx, [ebp - 0x178]
call fcn.00450d2f
mov dword [ebp - 0x20], ebx
jmp 0x475c67
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0xdb1d70f3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x475c54
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x475cea
mov esi, dword [ebp - 0x90]
mov dword [ebp - 0x34], 0xb9cbadbe
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, 0xfffffff8
setge cl
cmp ecx, dword [ebp - 0x24]
jle 0x475c9d
cmp dword [ebp - 0x34], ebx
mov edx, edi
jne 0x475c9f
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xfffffff7
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x178]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [esi + 8]
xor edx, edx
cmp dword [esi + 0xc], eax
setl dl
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x475c7b
lea ecx, [ebp - 0x178]
call fcn.00450e01
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffd
jle 0x475c35
lea ecx, [ebp - 0x90]
call fcn.00450e01
lea eax, [ebp - 0x264]
push eax
mov dl, byte [ebp + 0xc]
mov ecx, dword [ebp - 0x4c]
call fcn.0046a566
pop ecx
mov esi, eax
lea edi, [ebp - 0x78]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp + 0xc], 0
je 0x475ef9
cmp dword [ebp - 0x70], 0
je 0x475ef9
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x14], 0xa48bbca6
mov dword [ebp - 0x20], 0xffffffff
push 3
pop esi
push esi
lea ecx, [ebp - 0xc0]
call fcn.00450d2f
mov dword [ebp - 0x2c], ebx
jmp 0x475d77
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x475d68
mov dword [ebp - 0x14], ebx
jmp 0x475d90
mov dword [ebp - 0x28], 0xdc4b
cmp dword [ebp - 0x28], ebx
jne 0x475d96
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jg 0x475d81
xor edi, edi
inc edi
cmp dword [ebp - 0x14], ebx
jne 0x475dc9
mov edx, edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
add ecx, 0xcf46e11d
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, dword [ebp - 0x14]
je 0x475dc9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc0]
cmp dword [eax], ebx
jne 0x475de3
cmp dword [ebp - 0x20], ebx
mov eax, ebx
je 0x475de5
mov eax, edi
add eax, 0xd0561264
je 0x475ecf
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], 0xfafeceb2
mov dword [ebp - 0x34], 0xfffd
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], 0xfffffffe
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x475e27
push ebx
push 0x60c
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x44], 0xc19c50ed
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x475e4c
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x1c], ebx
jmp 0x475ec7
mov dword [ebp - 0x34], 0x1672
imul eax, dword [ebp - 0x34], 0xfffffffb
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x28], ebx
je 0x475e78
mov eax, dword [ebp - 0xc0]
cmp dword [eax + 4], ebx
mov dword [ebp - 0x34], edi
jne 0x475e7b
mov dword [ebp - 0x34], ebx
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp dword [edx + esi*4], eax
setl cl
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x34]
setle al
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp dword [ebp - 0x44], eax
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x475e51
jmp 0x475ee3
mov dword [ebp - 0x28], 0xfff9
mov dword [ebp - 0x44], 0xadbe56f6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0xc0]
call fcn.00450e01
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xc4], eax
jmp 0x475efc
xor edi, edi
inc edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x31e42a43
mov dword [ebp - 0x1d8], 0xfffffffe
mov dword [ebp - 0x1d4], 0xfffffffe
mov dword [ebp - 0x1d0], 0xfffffffe
mov dword [ebp - 0x1cc], 0xfffffffe
mov dword [ebp - 0x28], 0x75d5f8d9
mov dword [ebp - 0x28], 0x8475761a
mov dword [ebp - 0x28], edi
push 3
lea ecx, [ebp - 0x1b0]
call fcn.00450d2f
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x20], ebx
jmp 0x475f72
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0x674f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x475f5f
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x1b0]
call fcn.00450e01
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x476534
cmp dword [ebp - 0x78], esi
jle 0x476534
mov dword [ebp - 0x20], 0x5c68ec0a
mov dword [ebp - 0x24], 0xfff7
push 2
pop esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x38], 0x8ff7673e
mov dword [ebp - 0x20], ebx
jmp 0x4760a2
mov dword [ebp - 0x2c], 0x3bc6
cmp dword [ebp - 0x2c], ebx
je 0x475fe0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], eax
mov eax, edi
jg 0x475fe2
mov eax, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
jmp 0x476095
mov dword [ebp - 0x34], 0xdacd7d39
mov dword [ebp - 0x14], ebx
jmp 0x47600a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe8], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x475ff9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setle dl
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
mov eax, dword [ebp - 0x1c]
add eax, 0xd68c
add eax, ecx
cmp eax, dword [ebp - 0x2c]
jle 0x476042
cmp dword [ebp - 0x38], ebx
mov ecx, edi
jne 0x476044
mov ecx, ebx
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setg dl
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x24], ecx
jg 0x476063
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
je 0x476074
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe2
jge 0x475fed
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 7
jne 0x475fc4
mov dword [ebp - 0x14], ebx
jmp 0x476109
mov dword [ebp - 0x2c], 0x2781
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x2c], ebx
jne 0x4760e5
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x2c]
xor edx, edx
cmp eax, 0xae54
setge dl
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], ebx
je 0x4760e5
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x20], ebx
je 0x4760f1
cmp dword [ebp - 0x38], ebx
mov edx, edi
jne 0x4760f3
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jl 0x4760b1
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x44], 0x7a3ebef2
mov dword [ebp - 0x2c], ebx
push 3
lea ecx, [ebp - 0x100]
call fcn.00450d2f
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x476150
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x476146
mov dword [ebp - 0x14], ebx
jmp 0x476168
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x47615a
mov dword [ebp - 0x14], ebx
jmp 0x476185
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0x9f0ac772
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x476172
mov dword [ebp - 0x14], ebx
jmp 0x47619d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x230], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x476190
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xc
jne 0x4762df
mov dword [ebp - 0x24], 0xf38d
mov dword [ebp - 0x38], 0xe44142b9
mov dword [ebp - 0x38], 0x268
cmp dword [ebp - 0x38], 0x337
jle 0x476215
push ebx
push 0x333
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x28], ebx
lea eax, [ebx + esi]
or eax, edi
cdq
push edx
push eax
mov ecx, 0xaca3b8
call fcn.00450c1a
inc ebx
cmp ebx, 0x7e39
jl 0x4761e2
inc esi
cmp esi, 0x905
push 0
pop ebx
jl 0x4761df
inc edi
cmp edi, 0x3587
jl 0x4761dd
xor edi, edi
inc edi
mov dword [ebp - 4], 4
cmp dword [ebp - 0x38], 0xffffff47
jge 0x476234
mov edx, str.blozkwr_enohaass_uck_dqdywm_qdsxqzhb_nblgmo_vdkksqiu_hikqmr
mov ecx, 0xaca3b8
call fcn.004525c0
or dword [ebp - 4], 0xffffffff
jmp 0x476263
mov dword [ebp - 0x38], ebx
jmp 0x476279
cmp dword [ebp - 0x38], 3
jl 0x476268
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x64], ebx
je 0x476312
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x2c]
cmp eax, 0xfffffffd
mov ecx, edi
jne 0x476314
mov ecx, ebx
mov dword [ebp - 0x58], ecx
xor eax, eax
cmp ecx, 0xfffffff7
setg al
test eax, eax
je 0x476326
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], ebx
jne 0x47632e
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x14]
je 0x476339
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x100]
cmp dword [eax + 8], edi
setle cl
xor eax, eax
cmp ecx, 0xf82a
setle al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
imul ecx, eax, 0x1f9d
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setg dl
mov dword [ebp - 0x28], edx
lea ecx, [ebp - 0x100]
call fcn.00450e01
cmp dword [ebp - 0x74], 0
je 0x476531
lea ecx, [ebp - 0x78]
call fcn.00474bfd
push edi
lea ecx, [ebp - 0x154]
call fcn.00450d2f
mov dword [ebp - 0x28], 0xc7555b7c
mov dword [ebp - 0x3c], ebx
jmp 0x476567
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], 0x7e2799ac
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x476554
mov eax, dword [ebp - 0x154]
mov dword [eax], ebx
lea ecx, [ebp - 0x154]
call fcn.00450e01
cmp dword [ebp - 0x40], 0
jne 0x4765d7
test esi, esi
je 0x4765d7
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0x2304b25b
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x30], ebx
je 0x4765a3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
jmp 0x4765b9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x4765b9
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [ebp - 0x60]
push esi
call fcn.0044f3d3
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0xcc], esi
lea eax, [ebp - 0x5c]
push eax
call fcn.0047663f
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0xcc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret