Function at 0x4705e1
Capabilities:
Allocate thread local storage
Create pipe
Delete file
Get common file path
Get memory capacity
Get session user name
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x365c
call fcn.004a6c80
push esi
push edi
mov dword [ebp - 0xe4], 0xf782
push 2
lea ecx, [ebp - 0x29e4]
call fcn.004359e4
mov dword [ebp - 0x1dbc], 0xfffffffe
mov dword [ebp - 0x2018], 0xffffffff
mov dword [ebp - 0x3284], 0x98d72a67
mov dword [ebp - 0x1dc4], 0
mov dword [ebp - 0x630], 0
jmp 0x470648
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 2
jge 0x47066a
push dword [ebp - 0x630]
lea ecx, [ebp - 0x29e4]
call fcn.00435ad2
mov dword [eax], 0xfc2da8af
jmp 0x47063b
cmp dword [ebp - 0xe4], 0
jne 0x470760
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3208], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], eax
jg 0x47069d
mov dword [ebp - 0x1d24], 1
jmp 0x4706a4
and dword [ebp - 0x1d24], 0
cmp dword [ebp - 0xe4], 0x8a06
jl 0x4706bc
mov dword [ebp - 0x1670], 1
jmp 0x4706c3
and dword [ebp - 0x1670], 0
mov eax, dword [ebp - 0x1670]
sub eax, 0x4057
mov dword [ebp - 0x1d14], eax
push 1
lea ecx, [ebp - 0x29e4]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1d14]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x1d14], eax
jge 0x470703
mov dword [ebp - 0x1d1c], 1
jmp 0x47070a
and dword [ebp - 0x1d1c], 0
mov eax, dword [ebp - 0x1d1c]
neg eax
cmp dword [ebp - 0x1d24], eax
jne 0x470726
mov dword [ebp - 0x1d2c], 1
jmp 0x47072d
and dword [ebp - 0x1d2c], 0
cmp dword [ebp - 0x1d2c], 0
ja 0x470742
mov dword [ebp - 0x1d34], 1
jmp 0x470749
and dword [ebp - 0x1d34], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x1d34], eax
jg 0x470760
and dword [ebp - 0x1d3c], 0
jmp 0x47076a
mov dword [ebp - 0x1d3c], 1
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x1d3c], eax
je 0x470784
mov dword [ebp - 0x1d44], 1
jmp 0x47078b
and dword [ebp - 0x1d44], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x1d44], eax
je 0x4707a5
mov dword [ebp - 0x1db4], 1
jmp 0x4707ac
and dword [ebp - 0x1db4], 0
mov eax, dword [ebp - 0x1db4]
sub eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1dbc], eax
mov eax, dword [ebp - 0x1dbc]
mov dword [ebp - 0x2018], eax
mov eax, dword [ebp - 0x1dc4]
inc eax
mov dword [ebp - 0x1dc4], eax
lea ecx, [ebp - 0x29e4]
call fcn.00435ab6
mov dword [ebp - 0x270], 0x9714
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x270], 0x13
jmp 0x470812
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x26
jg 0x470851
cmp dword [ebp - 0x270], 0
je 0x470826
jmp 0x470851
mov byte [ebp - 0x3b4], 0
movzx eax, byte [ebp - 0x3b4]
test eax, eax
je 0x47084f
push 0x1db0
push 0
push 0x8c9
push 0x2a9
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x470805
mov dword [ebp - 0x1dcc], 1
mov dword [ebp - 0x8e8], 0x7bf0b96c
mov dword [ebp - 0x3c0], 6
mov dword [ebp - 0x1df4], 9
push 1
lea ecx, [ebp - 0x2954]
call fcn.004359e4
mov dword [ebp - 0x800], 0
jmp 0x47089f
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 1
jge 0x4708be
push dword [ebp - 0x800]
lea ecx, [ebp - 0x2954]
call fcn.00435ad2
and dword [eax], 0
jmp 0x470892
mov eax, dword [ebp - 0x1dcc]
inc eax
mov dword [ebp - 0x1dcc], eax
cmp dword [ebp - 0x8e8], 0
je 0x4709cd
mov dword [ebp - 0x4cc], 0x315362da
mov dword [ebp - 0x638], 0xfa32a17d
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x8e8], eax
je 0x470906
mov dword [ebp - 0x1dd4], 1
jmp 0x47090d
and dword [ebp - 0x1dd4], 0
mov dword [ebp - 0x638], 0x37c1
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x2f3c], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x3268], eax
mov eax, dword [ebp - 0x638]
add eax, dword [ebp - 0x4cc]
imul eax, dword [ebp - 0x4cc]
imul eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x1dd4], eax
jg 0x470966
cmp dword [ebp - 0x638], 0
je 0x470966
mov dword [ebp - 0x1ddc], 1
jmp 0x47096d
and dword [ebp - 0x1ddc], 0
mov eax, dword [ebp - 0x3c0]
cmp dword [ebp - 0x1ddc], eax
jle 0x470990
mov eax, 0x7fce6bb2
test eax, eax
je 0x470990
mov dword [ebp - 0x1de4], 1
jmp 0x470997
and dword [ebp - 0x1de4], 0
mov eax, dword [ebp - 0x8e8]
imul eax, dword [ebp - 0x1de4]
cmp eax, dword [ebp - 0x8e8]
jge 0x4709b8
mov dword [ebp - 0x1dec], 1
jmp 0x4709bf
and dword [ebp - 0x1dec], 0
mov eax, dword [ebp - 0x1dec]
mov dword [ebp - 0x1df4], eax
jmp 0x470a3b
mov dword [ebp - 0x3c0], 0
jmp 0x4709e6
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jg 0x470a13
mov dword [ebp - 0x1df4], 0x9dbc9b78
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x2954]
call fcn.00435ad2
cmp dword [eax], 0
je 0x470a11
jmp 0x4709d9
jmp 0x4709d9
mov byte [ebp - 0x23e], 0
movzx eax, byte [ebp - 0x23e]
test eax, eax
je 0x470a3b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [ebp - 0x2954]
call fcn.00435ab6
mov dword [ebp - 0xdc], 0xf782
mov dword [ebp - 8], 1
mov dword [ebp - 0x154], 9
push 3
lea ecx, [ebp - 0x24ec]
call fcn.004359e4
mov dword [ebp - 0x2f44], 0xfffffff9
mov dword [ebp - 0x3218], 1
mov dword [ebp - 0x2f4c], 0x9a1f
mov dword [ebp - 0x3270], 0xfffffff7
mov dword [ebp - 0x2f54], 0x93f07ca
mov dword [ebp - 0x640], 0
jmp 0x470ab9
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 3
jge 0x470adb
push dword [ebp - 0x640]
lea ecx, [ebp - 0x24ec]
call fcn.00435ad2
mov dword [eax], 7
jmp 0x470aac
xor eax, eax
inc eax
je 0x470faf
mov dword [ebp - 0x4c0], 0x5459eeda
mov dword [ebp - 0x4a0], 0xffff
mov dword [ebp - 0x808], 0
jmp 0x470b11
mov eax, dword [ebp - 0x808]
inc eax
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 2
jge 0x470b2d
mov eax, dword [ebp - 0x808]
mov dword [ebp + eax*4 - 0x590], 1
jmp 0x470b04
mov dword [ebp - 8], 0
jmp 0x470b3d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jg 0x470f92
mov dword [ebp - 0xb18], 0xfffffff6
mov dword [ebp - 0x1b0c], 0xffffffff
mov dword [ebp - 0x1b14], 0xfffc
mov dword [ebp - 0xb90], 1
mov dword [ebp - 0x22b0], 0
mov dword [ebp - 0x1b24], 3
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x590]
mov dword [ebp - 0x3228], eax
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x590], 0
je 0x470bbc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x590], 0
je 0x470bbc
mov dword [ebp - 0x1dfc], 1
jmp 0x470bc3
and dword [ebp - 0x1dfc], 0
mov eax, dword [ebp - 0x1dfc]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
sub eax, 0x7363
je 0x470bf7
cmp dword [ebp - 8], 0
je 0x470bf7
mov eax, 0x1d77f172
test eax, eax
je 0x470bf7
mov dword [ebp - 0x1e04], 1
jmp 0x470bfe
and dword [ebp - 0x1e04], 0
cmp dword [ebp - 0x1e04], 0xffff
je 0x470c16
mov dword [ebp - 0x1e0c], 1
jmp 0x470c1d
and dword [ebp - 0x1e0c], 0
cmp dword [ebp - 0x1e0c], 1
jl 0x470c36
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x470c36
and dword [ebp - 0x1e14], 0
jmp 0x470c40
mov dword [ebp - 0x1e14], 1
mov eax, dword [ebp - 0x1e14]
mov dword [ebp - 0xb18], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 8]
cmp dword [ebp + eax - 0x590], ecx
jl 0x470c6a
mov dword [ebp - 0x22a8], 1
jmp 0x470c71
and dword [ebp - 0x22a8], 0
mov eax, dword [ebp - 0x1b0c]
mov dword [ebp - 0x2f5c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3278], eax
mov eax, dword [ebp - 0x4a0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x590]
cmp eax, dword [ebp - 8]
jne 0x470caa
mov dword [ebp - 0x1e1c], 1
jmp 0x470cb1
and dword [ebp - 0x1e1c], 0
mov dword [ebp - 0x4c0], 0xf644accb
mov eax, dword [ebp - 0x1e1c]
add eax, 0xda73
cmp dword [ebp - 0x4c0], eax
jg 0x470cda
mov dword [ebp - 0x1e24], 1
jmp 0x470ce1
and dword [ebp - 0x1e24], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x590]
cmp eax, dword [ebp - 0x1e24]
jge 0x470cff
mov dword [ebp - 0x1e2c], 1
jmp 0x470d06
and dword [ebp - 0x1e2c], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x1e2c]
cmp eax, 0x5a27557b
jne 0x470d22
mov dword [ebp - 0x1d50], 1
jmp 0x470d29
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0x1d50]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x2f64], eax
cmp dword [ebp - 8], 0
je 0x470e90
cmp dword [ebp - 0x4c0], 0x1ede
jg 0x470d63
mov dword [ebp - 0xe78], 1
jmp 0x470d6a
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x590]
sub eax, dword [ebp - 0xe78]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xb18]
add eax, 0xfff8
neg eax
jne 0x470dad
cmp dword [ebp - 0x4a0], 0
jne 0x470dad
and dword [ebp - 0x1afc], 0
jmp 0x470db7
mov dword [ebp - 0x1afc], 1
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x590]
cmp dword [ebp - 0x1afc], eax
jge 0x470dd5
mov dword [ebp - 0xc70], 1
jmp 0x470ddc
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0x1b14]
cmp dword [ebp - 0xc70], eax
jl 0x470dfb
or eax, 0xffffffff
je 0x470dfb
mov dword [ebp - 0xa20], 1
jmp 0x470e02
and dword [ebp - 0xa20], 0
push 1
lea ecx, [ebp - 0x24ec]
call fcn.00435ad2
mov ecx, dword [ebp - 0xa20]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0xb90], eax
jne 0x470e3d
mov dword [ebp - 0x1b04], 1
jmp 0x470e44
and dword [ebp - 0x1b04], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x590]
cmp dword [ebp - 0x1b04], eax
jge 0x470e65
mov dword [ebp - 0xc78], 1
jmp 0x470e6c
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc78]
mov dword [ebp - 0x22b0], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0x3238], eax
cmp dword [ebp - 0x1b0c], 0
jne 0x470ea7
xor eax, eax
inc eax
jne 0x470ea7
mov eax, 0xa13e
test eax, eax
jne 0x470ea7
and dword [ebp - 0xc80], 0
jmp 0x470eb1
mov dword [ebp - 0xc80], 1
cmp dword [ebp - 0xc80], 0xde8b
jl 0x470ec9
mov dword [ebp - 0xc88], 1
jmp 0x470ed0
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0x1b14]
cmp dword [ebp - 0xc88], eax
je 0x470eea
mov dword [ebp - 0x1b1c], 1
jmp 0x470ef1
and dword [ebp - 0x1b1c], 0
mov eax, dword [ebp - 0x1b1c]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x4a0]
je 0x470f0e
mov dword [ebp - 0xc90], 1
jmp 0x470f15
and dword [ebp - 0xc90], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x590]
add eax, dword [ebp - 0xc90]
mov dword [ebp - 0x1b24], eax
mov eax, dword [ebp - 0x1b24]
sub eax, 0xf466
cmp eax, 0xfff6
jbe 0x470f4c
mov dword [ebp - 0xc98], 1
jmp 0x470f53
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc98]
sub ecx, dword [ebp + eax*4 - 0x590]
cmp ecx, dword [ebp - 8]
jle 0x470f74
mov dword [ebp - 0x1b2c], 1
jmp 0x470f7b
and dword [ebp - 0x1b2c], 0
mov eax, dword [ebp - 0x154]
add eax, dword [ebp - 0x1b2c]
mov dword [ebp - 0x154], eax
jmp 0x470b36
mov byte [ebp - 0x3bb], 0
movzx eax, byte [ebp - 0x3bb]
test eax, eax
je 0x470faa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x4710b4
mov dword [ebp - 0x2f6c], 0x505b3ea
mov dword [ebp - 0x3280], 0x4000348e
mov dword [ebp - 0x2f74], 0xfffffffd
mov dword [ebp - 0x3248], 0xfa7f9cd9
mov dword [ebp - 0x2f7c], 5
mov dword [ebp - 0x3288], 0
mov dword [ebp - 0x2f84], 0x4a1f699d
push 2
lea ecx, [ebp - 0x3074]
call fcn.004359e4
mov dword [ebp - 0x3258], 1
mov dword [ebp - 0x2f8c], 0xfffffffa
mov dword [ebp - 0x3290], 7
mov dword [ebp - 0x648], 0
jmp 0x471039
mov eax, dword [ebp - 0x648]
inc eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 2
jge 0x47105b
push dword [ebp - 0x648]
lea ecx, [ebp - 0x3074]
call fcn.00435ad2
mov dword [eax], 0xfffffffc
jmp 0x47102c
mov dword [ebp - 0x154], 0
jmp 0x471074
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x471096
push dword [ebp - 0x154]
lea ecx, [ebp - 0x24ec]
call fcn.00435ad2
mov dword [eax], 0xc3fc6c06
jmp 0x471067
push 1
lea ecx, [ebp - 0x24ec]
call fcn.00435ad2
mov dword [eax], 1
lea ecx, [ebp - 0x3074]
call fcn.00435ab6
lea ecx, [ebp - 0x24ec]
call fcn.00435ab6
push 2
lea ecx, [ebp - 0x2a14]
call fcn.004359e4
push 1
lea ecx, [ebp - 0x5f8]
call fcn.004359e4
mov dword [ebp - 0x24], 0x4896
mov dword [ebp - 0xa28], 0x6928694a
mov dword [ebp - 0xcb8], 0xffffffff
mov dword [ebp - 0x9b8], 0
jmp 0x47110d
mov eax, dword [ebp - 0x9b8]
inc eax
mov dword [ebp - 0x9b8], eax
cmp dword [ebp - 0x9b8], 1
jge 0x47112c
push dword [ebp - 0x9b8]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
or dword [eax], 0xffffffff
jmp 0x471100
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0
jmp 0x471143
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x4713e9
mov dword [ebp - 0x1b3c], 1
push 2
lea ecx, [ebp - 0x2704]
call fcn.004359e4
mov dword [ebp - 0x650], 0
jmp 0x47117d
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 2
jge 0x47119f
push dword [ebp - 0x650]
lea ecx, [ebp - 0x2704]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x471170
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
cmp dword [eax], 0
jne 0x47123c
push 0
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
cmp dword [eax], 0xd683
jle 0x4711ea
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
cmp dword [eax], 0
je 0x4711ea
mov dword [ebp - 0xca0], 1
jmp 0x4711f1
and dword [ebp - 0xca0], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov ecx, dword [ebp - 0xca0]
cmp ecx, dword [eax]
jge 0x471215
mov dword [ebp - 0x1b34], 1
jmp 0x47121c
and dword [ebp - 0x1b34], 0
push 0
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1b34]
cmp ecx, dword [eax]
je 0x47123c
and dword [ebp - 0xca8], 0
jmp 0x471246
mov dword [ebp - 0xca8], 1
push 0
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0x1b3c], eax
mov eax, dword [ebp - 0x1b3c]
mov dword [ebp - 0x22b8], eax
push 1
lea ecx, [ebp - 0x2704]
call fcn.00435ad2
mov ecx, dword [ebp - 0x22b8]
mov dword [eax], ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
push 1
lea ecx, [ebp - 0x2704]
call fcn.00435ad2
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
jle 0x4712ae
mov dword [ebp - 0xcb0], 1
jmp 0x4712b5
and dword [ebp - 0xcb0], 0
push 0
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov ecx, dword [ebp - 0xcb0]
add ecx, dword [eax]
mov dword [ebp - 0xa28], ecx
mov eax, dword [ebp - 0xa28]
sub eax, dword [ebp - 0x24]
cmp eax, 0x3d4c
jl 0x4712ec
mov dword [ebp - 0x22c0], 1
jmp 0x4712f3
and dword [ebp - 0x22c0], 0
push 0
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x2f94], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3298], eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x24]
cmp dword [eax], ecx
jg 0x471344
mov dword [ebp - 0x1b44], 1
jmp 0x47134b
and dword [ebp - 0x1b44], 0
mov eax, dword [ebp - 0x1b44]
sub eax, 0x96a9
mov dword [ebp - 0xcb8], eax
mov esi, dword [ebp - 0xcb8]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
cmp esi, dword [eax]
je 0x471380
mov dword [ebp - 0x1b4c], 1
jmp 0x471387
and dword [ebp - 0x1b4c], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x5f8]
call fcn.00435ad2
mov eax, dword [eax]
sub eax, dword [ebp - 0x1b4c]
je 0x4713c2
mov byte [ebp - 0x240], 0
movzx eax, byte [ebp - 0x240]
test eax, eax
je 0x4713c0
push 0
push 0x1e00
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x4713d9
mov dword [ebp - 0xcc0], 0x9757a83
mov eax, dword [ebp - 0xcc0]
dec eax
mov dword [ebp - 0xcc0], eax
lea ecx, [ebp - 0x2704]
call fcn.00435ab6
jmp 0x47113c
lea ecx, [ebp - 0x5f8]
call fcn.00435ab6
mov dword [ebp - 0x1bec], 0xfffffffe
mov dword [ebp - 0x434], 4
mov dword [ebp - 0x22d0], 0xffffffff
mov dword [ebp - 0xb20], 0x6c2e7ccc
mov dword [ebp - 0x22e0], 0x2f3ccd24
mov byte [ebp - 0x384], 0
movzx eax, byte [ebp - 0x384]
test eax, eax
je 0x471453
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x434], 0
je 0x471471
cmp dword [ebp - 0x434], 0
je 0x471471
mov dword [ebp - 0x22c8], 1
jmp 0x471478
and dword [ebp - 0x22c8], 0
cmp dword [ebp - 0x434], 0
jne 0x4714a3
cmp dword [ebp - 0x434], 0
jne 0x471491
cmp dword [ebp - 0x434], 0
cmp dword [ebp - 0x22d0], 0
jne 0x4714a3
and dword [ebp - 0x1b54], 0
jmp 0x4714ad
mov dword [ebp - 0x1b54], 1
cmp dword [ebp - 0x1b54], 0xfffffffd
jl 0x4714c2
mov dword [ebp - 0xcc8], 1
jmp 0x4714c9
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xb20], eax
je 0x4714ef
mov dword [ebp - 0x22d8], 1
jmp 0x4714f6
and dword [ebp - 0x22d8], 0
cmp dword [ebp - 0xb20], 0
mov eax, 0xfff6
imul eax, eax, 0xfd43ddca
mov dword [ebp - 0x22e0], eax
mov dword [ebp - 0x2394], 0xffffffff
mov dword [ebp - 0x1b5c], 0xffffffff
mov dword [ebp - 0x108], 0x457102d1
mov dword [ebp - 0xce0], 0xffffffff
mov dword [ebp - 0xcf8], 7
cmp dword [ebp - 0x1b5c], 0
je 0x47158c
mov eax, dword [ebp - 0x1b5c]
mov dword [ebp - 0x108], eax
mov byte [ebp - 0x242], 0
movzx eax, byte [ebp - 0x242]
test eax, eax
je 0x471587
push 0
push 0x1bce
push 0x1b49
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x4717d8
mov dword [ebp - 0x168], 0
jmp 0x4715a5
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x4715c1
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x2314], 0xfffffff9
jmp 0x471598
mov dword [ebp - 0x168], 0
jmp 0x4715da
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x4715f6
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x3324], 0xf20920a6
jmp 0x4715cd
mov byte [ebp - 0x3a0], 0
movzx eax, byte [ebp - 0x3a0]
test eax, eax
je 0x471610
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov dword [ebp - 0x108], 0
jmp 0x471629
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jg 0x4717d8
mov dword [ebp - 0xcd8], 0x520ea0c8
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0x2c68], eax
xor eax, eax
cmp eax, 0x6758e356
je 0x471661
mov dword [ebp - 0xcd0], 1
jmp 0x471668
and dword [ebp - 0xcd0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3324]
cmp dword [ebp - 0xcd0], eax
jle 0x471689
mov dword [ebp - 0x1b64], 1
jmp 0x471690
and dword [ebp - 0x1b64], 0
cmp dword [ebp - 0x1b64], 3
jb 0x4716a5
mov dword [ebp - 0x1b6c], 1
jmp 0x4716ac
and dword [ebp - 0x1b6c], 0
mov eax, dword [ebp - 0xcd8]
imul eax, dword [ebp - 0x1b6c]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0xce0]
cmp dword [ebp - 0x108], eax
je 0x4716d9
mov dword [ebp - 0x1b74], 1
jmp 0x4716e0
and dword [ebp - 0x1b74], 0
cmp dword [ebp - 0x1b74], 0x89a5
jne 0x4716f8
mov dword [ebp - 0x1b7c], 1
jmp 0x4716ff
and dword [ebp - 0x1b7c], 0
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp + eax*4 - 0x2314]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0xce8]
mov dword [ebp + eax*4 - 0x2314], ecx
mov eax, dword [ebp - 0xce8]
add eax, dword [ebp - 0x1b7c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x3324]
cmp eax, 0xfbb9
jl 0x471752
mov dword [ebp - 0xcf0], 1
jmp 0x471759
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0xcf0]
add eax, 0xfffb
jne 0x471782
mov eax, dword [ebp - 0x108]
cmp dword [ebp + eax*4 - 0x2314], 0
jne 0x471782
mov dword [ebp - 0x1b84], 1
jmp 0x471789
and dword [ebp - 0x1b84], 0
mov eax, dword [ebp - 0x1b84]
mov dword [ebp - 0xcf8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcf8]
mov dword [ebp + eax - 0x3324], ecx
mov byte [ebp - 0x244], 0
movzx eax, byte [ebp - 0x244]
test eax, eax
je 0x4717d3
push 0
push 0x21ce
push 0x8db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x47161c
mov dword [ebp - 0x2c70], 0x98d72a67
mov dword [ebp - 0x1bf4], 0
mov dword [ebp - 0xec], 5
push 1
lea ecx, [ebp - 0x29fc]
call fcn.004359e4
mov dword [ebp - 0x1b8c], 0x891023f1
mov dword [ebp - 0x277c], 0xfb26c4f3
mov dword [ebp - 0x2778], 0xfb26c4f3
mov dword [ebp - 0x2774], 0xfb26c4f3
mov dword [ebp - 0x2770], 0xfb26c4f3
lea ecx, [ebp - 0xb05]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x276c]
push eax
lea eax, [ebp - 0x277c]
push eax
lea ecx, [ebp - 0x3578]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3084]
call fcn.00435a90
mov dword [ebp - 0x22f0], 1
mov dword [ebp - 0x810], 0
jmp 0x47188d
mov eax, dword [ebp - 0x810]
inc eax
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 1
jge 0x4718af
push dword [ebp - 0x810]
lea ecx, [ebp - 0x29fc]
call fcn.00435ad2
mov dword [eax], 0xee973417
jmp 0x471880
mov dword [ebp - 0xec], 4
jmp 0x4718c8
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffe5
je 0x471a5b
mov dword [ebp - 0x548], 0x318d5816
mov dword [ebp - 0xd00], 0x60389a9b
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0xec], eax
jg 0x47190f
mov dword [ebp - 0x1b94], 1
jmp 0x471916
and dword [ebp - 0x1b94], 0
mov dword [ebp - 0x1b8c], 0xfffffff6
mov eax, dword [ebp - 0x1b8c]
mov dword [ebp - 0x2c78], eax
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0x2c80], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x2c88], eax
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0xd00]
add eax, 8
jne 0x471966
push 4
pop eax
test eax, eax
jne 0x471966
and dword [ebp - 0x22e8], 0
jmp 0x471970
mov dword [ebp - 0x22e8], 1
push 0
lea ecx, [ebp - 0x29fc]
call fcn.00435ad2
mov eax, 0x93d0b548
cmp eax, 0x7fffaa23
jbe 0x471995
mov dword [ebp - 0xa30], 1
jmp 0x47199c
and dword [ebp - 0xa30], 0
push 1
lea ecx, [ebp - 0x3084]
call fcn.00435ad2
mov ecx, dword [ebp - 0xa30]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xa30], eax
jge 0x4719cb
mov dword [ebp - 0xd08], 1
jmp 0x4719d2
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x1b94]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0xd08]
cmp dword [ebp - 0x548], eax
jge 0x4719ff
mov dword [ebp - 0x1b9c], 1
jmp 0x471a06
and dword [ebp - 0x1b9c], 0
cmp dword [ebp - 0x1b9c], 0x5a12
jg 0x471a1e
mov dword [ebp - 0xd10], 1
jmp 0x471a25
and dword [ebp - 0xd10], 0
mov eax, dword [ebp - 0xd10]
sub eax, 0x1081d6e7
cmp eax, 0xfff6
jne 0x471a43
mov dword [ebp - 0x1ba4], 1
jmp 0x471a4a
and dword [ebp - 0x1ba4], 0
mov eax, dword [ebp - 0x1ba4]
mov dword [ebp - 0x22f0], eax
jmp 0x4718bb
lea ecx, [ebp - 0x3084]
call fcn.00435ab6
lea ecx, [ebp - 0x29fc]
call fcn.00435ab6
mov dword [ebp - 0x22f8], 0xdcec
mov dword [ebp - 0xd18], 0xfffffffa
mov dword [ebp - 0x2374], 0xe31d8329
mov dword [ebp - 0x236c], 0xfffffff8
push 3
lea ecx, [ebp - 0x1fd8]
call fcn.004359e4
mov dword [ebp - 0x2c90], 4
mov dword [ebp - 0xbe8], 0x711e7bff
mov dword [ebp - 0xcc], 4
mov dword [ebp - 0x2364], 0x7a912e75
mov dword [ebp - 0x658], 0
jmp 0x471ae7
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 3
jge 0x471b06
push dword [ebp - 0x658]
lea ecx, [ebp - 0x1fd8]
call fcn.00435ad2
and dword [eax], 0
jmp 0x471ada
mov eax, dword [ebp - 0x22f8]
mov dword [ebp - 0xd18], eax
cmp dword [ebp - 0xd18], 0
je 0x471c07
mov dword [ebp - 0x2c98], 0xfffffffb
mov dword [ebp - 0x2308], 0xffffffff
mov dword [ebp - 0x2300], 4
mov dword [ebp - 0x2ca0], 4
mov dword [ebp - 0x2ca8], 2
push 2
lea ecx, [ebp - 0x1fd8]
call fcn.00435ad2
cmp dword [eax], 0xc60edac7
ja 0x471b72
mov dword [ebp - 0x1bac], 1
jmp 0x471b79
and dword [ebp - 0x1bac], 0
mov eax, dword [ebp - 0x2300]
cmp eax, dword [ebp - 0x1bac]
je 0x471b93
mov dword [ebp - 0xd20], 1
jmp 0x471b9a
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0x2308]
mov dword [ebp - 0x2cb0], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2cb8], eax
push 1
lea ecx, [ebp - 0x1fd8]
call fcn.00435ad2
cmp dword [eax], 0xc12a7b09
jb 0x471bd3
mov dword [ebp - 0x1bb4], 1
jmp 0x471bda
and dword [ebp - 0x1bb4], 0
mov eax, dword [ebp - 0xbe8]
mov ecx, dword [ebp - 0xd20]
add ecx, dword [ebp - 0x1bb4]
imul eax, ecx
mov dword [ebp - 0x2364], eax
mov eax, dword [ebp - 0xbe8]
inc eax
mov dword [ebp - 0xbe8], eax
jmp 0x471e37
push 2
lea ecx, [ebp - 0x2aa4]
call fcn.004359e4
mov dword [ebp - 0x1c0], 0
jmp 0x471c2d
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x471c4f
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x2aa4]
call fcn.00435ad2
mov dword [eax], 8
jmp 0x471c20
mov dword [ebp - 0x1c0], 0
jmp 0x471c68
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x471c84
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x2fa0], 0xf6a1241a
jmp 0x471c5b
mov dword [ebp - 0xcc], 0xfffffff5
jmp 0x471c9d
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffff5
jl 0x471df1
push 1
lea ecx, [ebp - 0x26f8]
call fcn.004359e4
mov dword [ebp - 0x8f0], 0
jmp 0x471cd0
mov eax, dword [ebp - 0x8f0]
inc eax
mov dword [ebp - 0x8f0], eax
cmp dword [ebp - 0x8f0], 1
jge 0x471cf2
push dword [ebp - 0x8f0]
lea ecx, [ebp - 0x26f8]
call fcn.00435ad2
mov dword [eax], 0xc1543f36
jmp 0x471cc3
cmp dword [ebp - 0x236c], 0
je 0x471d0d
mov eax, 0xe3d2f551
test eax, eax
jne 0x471d0d
and dword [ebp - 0xd28], 0
jmp 0x471d17
mov dword [ebp - 0xd28], 1
cmp dword [ebp - 0x2374], 0xffff
jne 0x471d2f
mov dword [ebp - 0x237c], 1
jmp 0x471d36
and dword [ebp - 0x237c], 0
push 0
lea ecx, [ebp - 0x26f8]
call fcn.00435ad2
push 0
lea ecx, [ebp - 0x2aa4]
call fcn.00435ad2
mov ecx, dword [ebp - 0xd28]
cmp ecx, dword [eax]
je 0x471d66
mov dword [ebp - 0x1bbc], 1
jmp 0x471d6d
and dword [ebp - 0x1bbc], 0
cmp dword [ebp - 0x1bbc], 1
jg 0x471d82
mov dword [ebp - 0xd30], 1
jmp 0x471d89
and dword [ebp - 0xd30], 0
push 0
lea ecx, [ebp - 0x26f8]
call fcn.00435ad2
mov ecx, dword [ebp - 0xd30]
cmp ecx, dword [eax]
jg 0x471dc7
push 2
lea ecx, [ebp - 0x1fd8]
call fcn.00435ad2
cmp dword [eax], 0
je 0x471dc7
mov eax, 0xd49acb08
test eax, eax
je 0x471dc7
mov dword [ebp - 0x1bc4], 1
jmp 0x471dce
and dword [ebp - 0x1bc4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc4]
mov dword [ebp + eax - 0x2fa0], ecx
lea ecx, [ebp - 0x26f8]
call fcn.00435ab6
jmp 0x471c90
mov dword [ebp - 0xcc], 0
jmp 0x471e0a
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x471e2c
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x1fd8]
call fcn.00435ad2
mov dword [eax], 0xed832cb8
jmp 0x471dfd
lea ecx, [ebp - 0x2aa4]
call fcn.00435ab6
lea ecx, [ebp - 0x1fd8]
call fcn.00435ab6
mov dword [ebp - 0x660], 0
jmp 0x471e5b
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 2
jge 0x471e7d
push dword [ebp - 0x660]
lea ecx, [ebp - 0x2a14]
call fcn.00435ad2
mov dword [eax], 0xfc2da8af
jmp 0x471e4e
mov dword [ebp - 0x818], 0xffffffff
mov dword [ebp - 0x238c], 0xaa6e6f7
mov dword [ebp - 0x818], 0xfffffff2
jmp 0x471eaa
mov eax, dword [ebp - 0x818]
dec eax
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0xffffffee
jl 0x471f43
mov dword [ebp - 0x668], 0
jmp 0x471ed0
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 3
jge 0x471eec
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0x26e0], 0
jmp 0x471ec3
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x26e0], 0
jmp 0x471f17
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x26e0]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x26e0], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x26e0], 9
jle 0x471f3e
mov dword [ebp - 0x2384], 1
mov eax, dword [ebp - 0x2384]
mov dword [ebp - 0x238c], eax
jmp 0x471efe
jmp 0x471e9d
cmp dword [ebp - 0xdc], 0
jne 0x472039
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2cc0], eax
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], eax
jg 0x471f76
mov dword [ebp - 0x1bd4], 1
jmp 0x471f7d
and dword [ebp - 0x1bd4], 0
cmp dword [ebp - 0xdc], 0x8a06
jl 0x471f95
mov dword [ebp - 0xd38], 1
jmp 0x471f9c
and dword [ebp - 0xd38], 0
mov eax, dword [ebp - 0xd38]
sub eax, 0x4057
mov dword [ebp - 0x1bcc], eax
push 1
lea ecx, [ebp - 0x2a14]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1bcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x1bcc], eax
jge 0x471fdc
mov dword [ebp - 0xd40], 1
jmp 0x471fe3
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
neg eax
cmp dword [ebp - 0x1bd4], eax
jne 0x471fff
mov dword [ebp - 0xd48], 1
jmp 0x472006
and dword [ebp - 0xd48], 0
cmp dword [ebp - 0xd48], 0
ja 0x47201b
mov dword [ebp - 0x1bdc], 1
jmp 0x472022
and dword [ebp - 0x1bdc], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x1bdc], eax
jg 0x472039
and dword [ebp - 0xd50], 0
jmp 0x472043
mov dword [ebp - 0xd50], 1
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0xd50], eax
je 0x47205d
mov dword [ebp - 0x1be4], 1
jmp 0x472064
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x1be4], eax
je 0x47207e
mov dword [ebp - 0xd58], 1
jmp 0x472085
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xd58]
sub eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1bec], eax
mov eax, dword [ebp - 0x1bec]
mov dword [ebp - 0x2394], eax
mov dword [ebp - 0xa38], 0x285faafe
mov dword [ebp - 0xb28], 0x72d9ee1c
mov dword [ebp - 0x968], 0xfffffffa
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x670], 0x3ddca272
mov byte [ebp - 0x386], 0
movzx eax, byte [ebp - 0x386]
test eax, eax
je 0x472104
push 0
push 0x835
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x2cc8], eax
xor eax, eax
inc eax
je 0x472134
mov dword [ebp - 0x968], 0x664a
cmp dword [ebp - 0x968], 0
je 0x472134
mov dword [ebp - 0x239c], 1
jmp 0x47213b
and dword [ebp - 0x239c], 0
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x2cd0], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2cd8], eax
mov eax, dword [ebp - 0x670]
dec eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2ce0], eax
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x968], eax
jl 0x472186
mov dword [ebp - 0x23a4], 1
jmp 0x47218d
and dword [ebp - 0x23a4], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x2ce8], eax
mov dword [ebp - 0xa38], 0xd9ba
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0x670]
cmp eax, dword [ebp - 0x278]
jl 0x4721cb
cmp dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0xb28]
add eax, 0x9d29
cmp eax, dword [ebp - 0x278]
jg 0x4721ea
mov dword [ebp - 0xd60], 1
jmp 0x4721f1
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x1bf4]
inc eax
mov dword [ebp - 0x1bf4], eax
lea ecx, [ebp - 0x2a14]
call fcn.00435ab6
push 1
lea ecx, [ebp - 0x610]
call fcn.004359e4
mov dword [ebp - 0x18], 0x4896
mov dword [ebp - 0xa40], 0x6928694a
mov dword [ebp - 0xd80], 0xffffffff
mov dword [ebp - 0x820], 0
jmp 0x472256
mov eax, dword [ebp - 0x820]
inc eax
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 1
jge 0x472275
push dword [ebp - 0x820]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
or dword [eax], 0xffffffff
jmp 0x472249
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x47228c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x472532
mov dword [ebp - 0x1c04], 1
push 2
lea ecx, [ebp - 0x25fc]
call fcn.004359e4
mov dword [ebp - 0x678], 0
jmp 0x4722c6
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 2
jge 0x4722e8
push dword [ebp - 0x678]
lea ecx, [ebp - 0x25fc]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x4722b9
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
cmp dword [eax], 0
jne 0x472385
push 0
lea ecx, [ebp - 0x610]
call fcn.00435ad2
cmp dword [eax], 0xd683
jle 0x472333
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
cmp dword [eax], 0
je 0x472333
mov dword [ebp - 0xd68], 1
jmp 0x47233a
and dword [ebp - 0xd68], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov ecx, dword [ebp - 0xd68]
cmp ecx, dword [eax]
jge 0x47235e
mov dword [ebp - 0x1bfc], 1
jmp 0x472365
and dword [ebp - 0x1bfc], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1bfc]
cmp ecx, dword [eax]
je 0x472385
and dword [ebp - 0xd70], 0
jmp 0x47238f
mov dword [ebp - 0xd70], 1
push 0
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov eax, dword [ebp - 0xd70]
mov dword [ebp - 0x1c04], eax
mov eax, dword [ebp - 0x1c04]
mov dword [ebp - 0x23ac], eax
push 1
lea ecx, [ebp - 0x25fc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x23ac]
mov dword [eax], ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
push 1
lea ecx, [ebp - 0x25fc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x18]
cmp dword [eax], ecx
jle 0x4723f7
mov dword [ebp - 0xd78], 1
jmp 0x4723fe
and dword [ebp - 0xd78], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov ecx, dword [ebp - 0xd78]
add ecx, dword [eax]
mov dword [ebp - 0xa40], ecx
mov eax, dword [ebp - 0xa40]
sub eax, dword [ebp - 0x18]
cmp eax, 0x3d4c
jl 0x472435
mov dword [ebp - 0x23b4], 1
jmp 0x47243c
and dword [ebp - 0x23b4], 0
push 0
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x2cf0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2cf8], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov ecx, dword [ebp - 0x18]
cmp dword [eax], ecx
jg 0x47248d
mov dword [ebp - 0x1c0c], 1
jmp 0x472494
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x1c0c]
sub eax, 0x96a9
mov dword [ebp - 0xd80], eax
mov esi, dword [ebp - 0xd80]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
cmp esi, dword [eax]
je 0x4724c9
mov dword [ebp - 0x1c14], 1
jmp 0x4724d0
and dword [ebp - 0x1c14], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x610]
call fcn.00435ad2
mov eax, dword [eax]
sub eax, dword [ebp - 0x1c14]
je 0x47250b
mov byte [ebp - 0x246], 0
movzx eax, byte [ebp - 0x246]
test eax, eax
je 0x472509
push 0
push 0x1e00
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x472522
mov dword [ebp - 0xd88], 0x9757a83
mov eax, dword [ebp - 0xd88]
dec eax
mov dword [ebp - 0xd88], eax
lea ecx, [ebp - 0x25fc]
call fcn.00435ab6
jmp 0x472285
lea ecx, [ebp - 0x610]
call fcn.00435ab6
cmp dword [ebp + 8], 2
jl 0x47cc19
mov dword [ebp - 0xac], 1
mov dword [ebp - 0xd4], 0xffffffff
mov dword [ebp - 0x1c3c], 5
mov dword [ebp - 0x2d00], 0x5b16
mov dword [ebp - 0xac], 0
jmp 0x472588
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xffffffea
jle 0x4726fd
mov dword [ebp - 0xd90], 0x55145ccb
mov dword [ebp - 0x23bc], 0
mov dword [ebp - 0x8f8], 0
jmp 0x4725c2
mov eax, dword [ebp - 0x8f8]
inc eax
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 3
jge 0x4725de
mov eax, dword [ebp - 0x8f8]
mov dword [ebp + eax*4 - 0x26a4], 0x2285
jmp 0x4725b5
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2d08], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jge 0x472604
mov dword [ebp - 0x1c1c], 1
jmp 0x47260b
and dword [ebp - 0x1c1c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26a4]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd90], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x26a4]
imul ecx, dword [ebp - 0xd90]
mov edx, dword [ebp - 0xac]
sub edx, ecx
cmp edx, dword [ebp + eax - 0x26a4]
jl 0x472667
mov dword [ebp - 0x1c24], 1
jmp 0x47266e
and dword [ebp - 0x1c24], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1c24], eax
jne 0x472688
mov dword [ebp - 0xd98], 1
jmp 0x47268f
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0x23bc], eax
mov dword [ebp - 0xd4], 2
jmp 0x4726b4
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x4726f8
mov dword [ebp - 0x23c4], 0xf6658d83
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x26a4], 1
je 0x4726e3
mov dword [ebp - 0x1c2c], 1
jmp 0x4726ea
and dword [ebp - 0x1c2c], 0
mov eax, dword [ebp - 0x1c2c]
mov dword [ebp - 0x23c4], eax
jmp 0x4726a7
jmp 0x47257b
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x2d10], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1c3c], eax
jle 0x472723
mov dword [ebp - 0xda0], 1
jmp 0x47272a
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xac], eax
je 0x472744
mov dword [ebp - 0x1c34], 1
jmp 0x47274b
and dword [ebp - 0x1c34], 0
mov eax, dword [ebp - 0xda0]
cmp eax, dword [ebp - 0x1c34]
jl 0x472765
mov dword [ebp - 0xda8], 1
jmp 0x47276c
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x1c3c], eax
mov dword [ebp - 0xa4], 0xffff
mov dword [ebp - 0x280], 0xed6b6572
mov dword [ebp - 0xdb0], 0x5befa1e1
mov dword [ebp - 0x3cc], 0x1ba6b42b
push 2
lea ecx, [ebp - 0x2614]
call fcn.004359e4
mov dword [ebp - 0x23d4], 3
mov dword [ebp - 0x2d18], 0x77f0a061
mov dword [ebp - 0x680], 0
jmp 0x4727da
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 2
jge 0x4727fc
push dword [ebp - 0x680]
lea ecx, [ebp - 0x2614]
call fcn.00435ad2
mov dword [eax], 0xc14ab653
jmp 0x4727cd
mov byte [ebp - 0x3ae], 0
movzx eax, byte [ebp - 0x3ae]
test eax, eax
je 0x47281b
push 0
push 0x21c4
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], eax
jne 0x472835
mov dword [ebp - 0x1c5c], 1
jmp 0x47283c
and dword [ebp - 0x1c5c], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xdb0], eax
jle 0x472862
mov dword [ebp - 0x1c44], 1
jmp 0x472869
and dword [ebp - 0x1c44], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1c44], eax
jg 0x472883
mov dword [ebp - 0xdb8], 1
jmp 0x47288a
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0xdb8]
sub eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa4]
jg 0x4728aa
mov dword [ebp - 0x1c4c], 1
jmp 0x4728b1
and dword [ebp - 0x1c4c], 0
cmp dword [ebp - 0x1c4c], 0x2717f403
jg 0x4728c9
mov dword [ebp - 0xdc0], 1
jmp 0x4728d0
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x280], eax
jl 0x472902
mov dword [ebp - 0xb98], 1
jmp 0x472909
and dword [ebp - 0xb98], 0
push 1
lea ecx, [ebp - 0x2614]
call fcn.00435ad2
mov ecx, dword [ebp - 0xb98]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xb98]
cmp eax, dword [ebp - 0xa4]
je 0x472948
xor eax, eax
jne 0x472948
cmp dword [ebp - 0x280], 0
jne 0x472948
and dword [ebp - 0x1c54], 0
jmp 0x472952
mov dword [ebp - 0x1c54], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1c54], eax
jg 0x47296c
mov dword [ebp - 0xdc8], 1
jmp 0x472973
and dword [ebp - 0xdc8], 0
imul eax, dword [ebp - 0xdc8], 0xe696
cmp dword [ebp - 0x1c5c], eax
je 0x472b6e
mov dword [ebp - 0x828], 0
jmp 0x4729a2
mov eax, dword [ebp - 0x828]
inc eax
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 2
jge 0x4729be
mov eax, dword [ebp - 0x828]
mov dword [ebp + eax*4 - 0x2724], 4
jmp 0x472995
mov dword [ebp - 0x3cc], 0xc
jmp 0x4729d7
mov eax, dword [ebp - 0x3cc]
dec eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 9
jg 0x472b6c
push 2
lea ecx, [ebp - 0x24fc]
call fcn.004359e4
mov dword [ebp - 0x23dc], 0
mov dword [ebp - 0x110], 0
jmp 0x472a14
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x472a36
push dword [ebp - 0x110]
lea ecx, [ebp - 0x24fc]
call fcn.00435ad2
mov dword [eax], 0x494d
jmp 0x472a07
mov dword [ebp - 0x110], 0
jmp 0x472a4f
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jge 0x472a6b
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x23e4], 0x731d497c
jmp 0x472a42
push 0
lea ecx, [ebp - 0x24fc]
call fcn.00435ad2
cmp dword [eax], 9
jg 0x472a89
mov dword [ebp - 0x23cc], 1
jmp 0x472a90
and dword [ebp - 0x23cc], 0
push 0
lea ecx, [ebp - 0x24fc]
call fcn.00435ad2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2724]
mov dword [ebp - 0x2d20], eax
push 0
lea ecx, [ebp - 0x24fc]
call fcn.00435ad2
mov eax, dword [ebp - 0x23d4]
neg eax
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2724]
test eax, eax
je 0x472aec
cmp dword [ebp - 0x23dc], 0
je 0x472aec
mov dword [ebp - 0xa48], 1
jmp 0x472af3
and dword [ebp - 0xa48], 0
push 1
lea ecx, [ebp - 0x2614]
call fcn.00435ad2
mov ecx, dword [ebp - 0xa48]
mov dword [eax], ecx
imul eax, dword [ebp - 0xa48], 0xffff
cmp eax, 1
jle 0x472b23
mov dword [ebp - 0xdd0], 1
jmp 0x472b2a
and dword [ebp - 0xdd0], 0
cmp dword [ebp - 0xdd0], 0xfff9
jne 0x472b42
mov dword [ebp - 0x1c64], 1
jmp 0x472b49
and dword [ebp - 0x1c64], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c64]
mov dword [ebp + eax - 0x23e4], ecx
lea ecx, [ebp - 0x24fc]
call fcn.00435ab6
jmp 0x4729ca
jmp 0x472ba7
mov dword [ebp - 0x23ec], 0x5dc8ff05
mov dword [ebp - 0x280], 0xa
jmp 0x472b91
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x33
jge 0x472ba7
cmp dword [ebp - 0x23ec], 0
je 0x472ba5
jmp 0x472ba7
jmp 0x472b84
lea ecx, [ebp - 0x2614]
call fcn.00435ab6
mov dword [ebp - 0x9a0], 0x40d7f825
push 3
lea ecx, [ebp - 0x2b04]
call fcn.004359e4
mov dword [ebp - 0x688], 0
jmp 0x472be2
mov eax, dword [ebp - 0x688]
inc eax
mov dword [ebp - 0x688], eax
cmp dword [ebp - 0x688], 3
jge 0x472c04
push dword [ebp - 0x688]
lea ecx, [ebp - 0x2b04]
call fcn.00435ad2
mov dword [eax], 7
jmp 0x472bd5
mov dword [ebp - 0x9a0], 0xfffffff1
jmp 0x472c1d
mov eax, dword [ebp - 0x9a0]
dec eax
mov dword [ebp - 0x9a0], eax
cmp dword [ebp - 0x9a0], 0xfffffff0
jne 0x472c78
mov dword [ebp - 0x46c], 0x4b25b3b9
mov dword [ebp - 0x46c], 0
jmp 0x472c49
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 3
jge 0x472c6b
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x2b04]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x472c3c
cmp dword [ebp - 0x46c], 0
je 0x472c76
jmp 0x472c10
jmp 0x472c10
lea ecx, [ebp - 0x2b04]
call fcn.00435ab6
mov dword [ebp - 0x286c], 1
mov dword [ebp - 0x2868], 1
mov dword [ebp - 0x2864], 1
mov dword [ebp - 0x2860], 1
lea ecx, [ebp - 0x9fd]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x285c]
push eax
lea eax, [ebp - 0x286c]
push eax
lea ecx, [ebp - 0x3550]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2014]
call fcn.00435a90
mov dword [ebp - 0xea8], 0x23498e64
mov dword [ebp - 0x1c7c], 6
mov dword [ebp - 0x240c], 1
mov dword [ebp - 0x2424], 0xb4456e34
mov dword [ebp - 0x1c74], 0x37aced45
mov dword [ebp - 0x2d28], 0xffffffff
mov dword [ebp - 0x2d30], 1
mov dword [ebp - 0x241c], 0xae28de6
push 3
lea ecx, [ebp - 0x262c]
call fcn.004359e4
push 1
lea ecx, [ebp - 0x26c8]
call fcn.004359e4
mov dword [ebp - 0xb30], 0x922a1982
mov dword [ebp - 0xa50], 1
mov dword [ebp - 0x1c6c], 0x95b676b
push 4
lea ecx, [ebp - 0x2a2c]
call fcn.004359e4
mov dword [ebp - 0x1c8c], 0x23e6
mov dword [ebp - 0x68], 0
jmp 0x472d8f
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x472dab
push dword [ebp - 0x68]
lea ecx, [ebp - 0x262c]
call fcn.00435ad2
mov dword [eax], 0xfffffff7
jmp 0x472d88
mov dword [ebp - 0x68], 0
jmp 0x472dbb
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x472dd7
push dword [ebp - 0x68]
lea ecx, [ebp - 0x26c8]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x472db4
mov dword [ebp - 0x68], 0
jmp 0x472de7
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x472e03
push dword [ebp - 0x68]
lea ecx, [ebp - 0x2a2c]
call fcn.00435ad2
mov dword [eax], 0xb650
jmp 0x472de0
mov eax, dword [ebp - 0x1c7c]
mov dword [ebp - 0x2d38], eax
push 0
lea ecx, [ebp - 0x26c8]
call fcn.00435ad2
cmp dword [eax], 0x38d1
jl 0x472e30
mov dword [ebp - 0xdd8], 1
jmp 0x472e37
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x1c74]
add eax, dword [ebp - 0xdd8]
mov dword [ebp - 0x1c6c], eax
mov esi, dword [ebp - 0x1c6c]
push 2
lea ecx, [ebp - 0x262c]
call fcn.00435ad2
cmp esi, dword [eax]
jne 0x472e6c
mov dword [ebp - 0xde0], 1
jmp 0x472e73
and dword [ebp - 0xde0], 0
cmp dword [ebp - 0xde0], 8
jae 0x472e88
mov dword [ebp - 0xde8], 1
jmp 0x472e8f
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xb30]
inc eax
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0xa50]
mov dword [ebp - 0x23f4], eax
mov eax, dword [ebp - 0x1c74]
add eax, dword [ebp - 0xde8]
mov dword [ebp - 0x23fc], eax
mov eax, dword [ebp - 0xb30]
inc eax
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x23f4]
cmp eax, dword [ebp - 0x23fc]
jle 0x472ee1
mov dword [ebp - 0x2404], 1
jmp 0x472ee8
and dword [ebp - 0x2404], 0
mov eax, dword [ebp - 0x240c]
imul eax, dword [ebp - 0x1c7c]
cmp eax, dword [ebp - 0xa50]
jge 0x472f09
mov dword [ebp - 0x2414], 1
jmp 0x472f10
and dword [ebp - 0x2414], 0
push 2
lea ecx, [ebp - 0x262c]
call fcn.00435ad2
push 0
lea ecx, [ebp - 0x26c8]
call fcn.00435ad2
cmp dword [eax], 0xb26de0d6
jb 0x472f3e
mov dword [ebp - 0xdf0], 1
jmp 0x472f45
and dword [ebp - 0xdf0], 0
cmp dword [ebp - 0xdf0], 0xe874
jl 0x472f5d
mov dword [ebp - 0x1c84], 1
jmp 0x472f64
and dword [ebp - 0x1c84], 0
push 0
lea ecx, [ebp - 0x2a2c]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1c84]
cmp ecx, dword [eax]
je 0x472f87
mov dword [ebp - 0xdf8], 1
jmp 0x472f8e
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0x1c8c], eax
cmp dword [ebp - 0x1c8c], 0xffffffff
je 0x472faf
mov dword [ebp - 0xe00], 1
jmp 0x472fb6
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0xe00]
sub eax, dword [ebp - 0x241c]
mov dword [ebp - 0x2424], eax
lea ecx, [ebp - 0x2a2c]
call fcn.00435ab6
lea ecx, [ebp - 0x26c8]
call fcn.00435ab6
lea ecx, [ebp - 0x262c]
call fcn.00435ab6
mov dword [ebp - 0x2484], 0xacff8ee1
mov dword [ebp - 0x4c8], 0xffffffff
mov dword [ebp - 0xb38], 0xe4f20077
mov dword [ebp - 0x690], 0
jmp 0x473020
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 1
jge 0x47303c
mov eax, dword [ebp - 0x690]
mov dword [ebp + eax*4 - 0x43c], 0x1d925b0e
jmp 0x473013
mov dword [ebp - 0x4c8], 0xfffffffa
mov dword [ebp - 0x4c8], 0
jmp 0x47305f
mov eax, dword [ebp - 0x4c8]
inc eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0
jg 0x4733b4
mov dword [ebp - 0x94], 8
mov dword [ebp - 0x3d4], 0x6a0122d8
mov dword [ebp - 0x94], 0
jmp 0x473099
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jg 0x4733af
mov dword [ebp - 0x243c], 0x2bf390f3
mov dword [ebp - 0x830], 0
jmp 0x4730c9
mov eax, dword [ebp - 0x830]
inc eax
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 2
jge 0x4730e5
mov eax, dword [ebp - 0x830]
mov dword [ebp + eax*4 - 0x2320], 0xfffe
jmp 0x4730bc
mov eax, dword [ebp - 0x94]
cmp dword [ebp + eax*4 - 0x43c], 0
je 0x4731fc
cmp dword [ebp - 0x94], 0
je 0x4731fc
mov dword [ebp - 0xbd0], 0x3d37
mov dword [ebp - 0x242c], 0xffffffff
cmp dword [ebp - 0x94], 0x5f5b
jle 0x473132
mov dword [ebp - 0x1c94], 1
jmp 0x473139
and dword [ebp - 0x1c94], 0
imul eax, dword [ebp - 0x1c94], 0x6fd4
cmp eax, dword [ebp - 0xbd0]
jl 0x473157
mov dword [ebp - 0xe08], 1
jmp 0x47315e
and dword [ebp - 0xe08], 0
cmp dword [ebp - 0xe08], 0x3ccd2466
jl 0x47317f
cmp dword [ebp - 0xbd0], 0
je 0x47317f
mov dword [ebp - 0x1c9c], 1
jmp 0x473186
and dword [ebp - 0x1c9c], 0
cmp dword [ebp - 0x1c9c], 8
jge 0x47319b
mov dword [ebp - 0xe10], 1
jmp 0x4731a2
and dword [ebp - 0xe10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2320]
cmp dword [ebp - 0xe10], eax
jl 0x4731c3
mov dword [ebp - 0x1ca4], 1
jmp 0x4731ca
and dword [ebp - 0x1ca4], 0
mov eax, dword [ebp - 0xbd0]
cmp eax, dword [ebp - 0x1ca4]
jne 0x4731e4
mov dword [ebp - 0xe18], 1
jmp 0x4731eb
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0x242c], eax
jmp 0x4732fb
mov dword [ebp - 0xa58], 1
mov dword [ebp - 0x2434], 0xfffffff8
mov dword [ebp - 0x2d40], 0xe2095e04
mov dword [ebp - 0x2d48], 0xfffffff7
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x43c]
mov dword [ebp - 0x2d50], eax
mov eax, dword [ebp - 0xa58]
cmp dword [ebp - 0xa58], eax
jl 0x473251
mov dword [ebp - 0x1cac], 1
jmp 0x473258
and dword [ebp - 0x1cac], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xa58], eax
jle 0x473272
mov dword [ebp - 0xe20], 1
jmp 0x473279
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0x1cac]
cmp eax, dword [ebp - 0xe20]
jle 0x473293
mov dword [ebp - 0x1cb4], 1
jmp 0x47329a
and dword [ebp - 0x1cb4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2320]
sub eax, dword [ebp - 0x1cb4]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x43c]
mov ecx, dword [ebp - 0x94]
add eax, dword [ebp + ecx*4 - 0x43c]
cmp eax, dword [ebp - 0x2434]
jle 0x4732db
mov dword [ebp - 0xe28], 1
jmp 0x4732e2
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
mov dword [ebp - 0x243c], eax
mov eax, dword [ebp - 0xb38]
dec eax
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0x3d4], 0
jmp 0x473314
mov eax, dword [ebp - 0x3d4]
dec eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0
jl 0x4733aa
mov dword [ebp - 0x2444], 0xd757520c
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0xb38]
cmp dword [ebp + eax*4 - 0x43c], ecx
jle 0x47334c
mov dword [ebp - 0x1cbc], 1
jmp 0x473353
and dword [ebp - 0x1cbc], 0
cmp dword [ebp - 0x1cbc], 0
je 0x473376
mov eax, dword [ebp - 0x3d4]
mov eax, dword [ebp + eax*4 - 0x43c]
mov dword [ebp - 0x2d58], eax
cmp dword [ebp - 0x94], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2320], 1
jg 0x473392
mov dword [ebp - 0xe30], 1
jmp 0x473399
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0x2444], eax
jmp 0x473307
jmp 0x47308c
jmp 0x473052
push 1
lea ecx, [ebp - 0x2014]
call fcn.00435ad2
mov dword [eax], 0xfffffff2
jmp 0x4733ed
push 1
lea ecx, [ebp - 0x2014]
call fcn.00435ad2
cmp dword [eax], 0xffffffe6
jl 0x473d06
mov dword [ebp - 0xba0], 0xffffffff
push 2
lea ecx, [ebp - 0x2b4c]
call fcn.004359e4
mov dword [ebp - 0x900], 5
mov dword [ebp - 0x698], 0
jmp 0x47343d
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 2
jge 0x47345f
push dword [ebp - 0x698]
lea ecx, [ebp - 0x2b4c]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x473430
mov dword [ebp - 0x900], 1
jmp 0x473478
mov eax, dword [ebp - 0x900]
dec eax
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 0
jl 0x473497
push 1
lea ecx, [ebp - 0x2b4c]
call fcn.00435ad2
cmp dword [eax], 0
je 0x473495
jmp 0x473497
jmp 0x47346b
lea ecx, [ebp - 0x2b4c]
call fcn.00435ab6
mov dword [ebp - 0x6a0], 0x399841b3
mov dword [ebp - 0x6a0], 0
jmp 0x4734c5
mov eax, dword [ebp - 0x6a0]
dec eax
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0xffffffe8
jg 0x47355d
mov dword [ebp - 0x838], 0xffffffff
mov dword [ebp - 0x838], 0x1a
jmp 0x4734f5
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0xffffffe4
jg 0x473558
mov byte [ebp - 0x248], 0
movzx eax, byte [ebp - 0x248]
test eax, eax
je 0x473535
push 0x933
push 0
push 0x1d22
push 0x1cda
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov byte [ebp - 0x388], 0
movzx eax, byte [ebp - 0x388]
test eax, eax
je 0x473556
push 0xfa0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x4734e8
jmp 0x4734b8
mov byte [ebp - 0x24a], 0
mov dword [ebp - 0x970], 0x8462751c
mov dword [ebp - 0xe48], 0xe03
push 4
lea ecx, [ebp - 0xc44]
call fcn.004359e4
mov dword [ebp - 0xe38], 0xfffd
mov dword [ebp - 0x244c], 0
mov dword [ebp - 0x245c], 0
mov dword [ebp - 0x6a8], 0
jmp 0x4735bc
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 4
jge 0x4735de
push dword [ebp - 0x6a8]
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
mov dword [eax], 0x15546710
jmp 0x4735af
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x2d60], eax
mov eax, dword [ebp - 0xe38]
inc eax
mov dword [ebp - 0xe38], eax
push 0
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
mov esi, dword [ebp - 0xe48]
push 3
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
cmp esi, dword [eax]
jge 0x473627
mov dword [ebp - 0x1ccc], 1
jmp 0x47362e
and dword [ebp - 0x1ccc], 0
cmp dword [ebp - 0x1ccc], 0x69be5411
je 0x473646
mov dword [ebp - 0xe40], 1
jmp 0x47364d
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 0xba8d7d2a
je 0x473665
mov dword [ebp - 0x1cd4], 1
jmp 0x47366c
and dword [ebp - 0x1cd4], 0
push 2
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1cd4]
sub ecx, dword [ebp - 0xe48]
cmp dword [eax], ecx
jg 0x473695
mov dword [ebp - 0x1cdc], 1
jmp 0x47369c
and dword [ebp - 0x1cdc], 0
push 1
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1cdc]
cmp ecx, dword [eax]
jg 0x4736bf
mov dword [ebp - 0xe50], 1
jmp 0x4736c6
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0x970]
cmp dword [ebp - 0xe50], eax
jg 0x4736e0
mov dword [ebp - 0x1ce4], 1
jmp 0x4736e7
and dword [ebp - 0x1ce4], 0
push 3
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1ce4]
imul ecx, dword [eax]
test ecx, ecx
jne 0x473713
cmp dword [ebp - 0x244c], 0
jne 0x473713
mov dword [ebp - 0x2454], 1
push 3
lea ecx, [ebp - 0xc44]
call fcn.00435ad2
cmp dword [ebp - 0x245c], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x2d68], eax
mov eax, dword [ebp - 0x970]
inc eax
imul eax, eax, 0xffff
test eax, eax
je 0x473763
lea ecx, [ebp - 0x2014]
call fcn.00435ab6
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x288], 0xbef9f3b0
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xa756a336
jae 0x473d48
mov dword [ebp - 0xeb0], 1
jmp 0x473d4f
and dword [ebp - 0xeb0], 0
cmp dword [ebp - 0x3c], 1
je 0x473d61
mov dword [ebp - 0x16d8], 1
jmp 0x473d68
and dword [ebp - 0x16d8], 0
mov eax, dword [ebp - 0xeb0]
cmp eax, dword [ebp - 0x16d8]
jne 0x473d82
mov dword [ebp - 0xeb8], 1
jmp 0x473d89
and dword [ebp - 0xeb8], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xeb8]
neg eax
add eax, 0x4b370f30
je 0x473fca
mov dword [ebp - 0x16e8], 6
mov dword [ebp - 0x170], 0
jmp 0x473dc3
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x473ddf
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x9cc], 0x36de
jmp 0x473db6
mov dword [ebp - 0x170], 0
jmp 0x473df8
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x473e14
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2be4], 1
jmp 0x473deb
mov dword [ebp - 0x3c], 0
jmp 0x473e24
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x473f8b
mov dword [ebp - 0xec0], 0x955205
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x9cc]
mov dword [ebp - 0x2d80], eax
cmp dword [ebp - 0x3c], 0
je 0x473efc
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x9cc]
mov dword [ebp - 0x2d88], eax
xor eax, eax
jne 0x473e74
xor eax, eax
inc eax
jne 0x473e74
and dword [ebp - 0x1d4c], 0
jmp 0x473e7e
mov dword [ebp - 0x1d4c], 1
mov eax, dword [ebp - 0x1d4c]
mov dword [ebp - 0xec0], eax
mov eax, dword [ebp - 0xec0]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x9cc]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x9cc]
jge 0x473eb8
mov dword [ebp - 0x16e0], 1
jmp 0x473ebf
and dword [ebp - 0x16e0], 0
cmp dword [ebp - 0x16e0], 1
jg 0x473ed4
mov dword [ebp - 0xec8], 1
jmp 0x473edb
and dword [ebp - 0xec8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9cc]
add eax, dword [ebp - 0xec8]
je 0x473efc
mov dword [ebp - 0x1af0], 1
jmp 0x473f03
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x1af0]
neg eax
mov ecx, dword [ebp - 0x3c]
cmp eax, dword [ebp + ecx*4 - 0x9cc]
jg 0x473f23
mov dword [ebp - 0xed0], 1
jmp 0x473f2a
and dword [ebp - 0xed0], 0
mov eax, dword [ebp - 0xed0]
mov dword [ebp - 0x16e8], eax
mov eax, dword [ebp - 0x16e8]
mov ecx, dword [ebp - 0x3c]
imul eax, dword [ebp + ecx*4 - 0x9cc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x9cc]
jge 0x473f62
mov dword [ebp - 0x248c], 1
jmp 0x473f69
and dword [ebp - 0x248c], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x2d90], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2be4], 0xe96bb645
jmp 0x473e1d
mov byte [ebp - 0x24c], 0
movzx eax, byte [ebp - 0x24c]
test eax, eax
je 0x473fc5
push 0x115
push 0x2525
push 0x12f6
push 0x198
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x4741b4
mov dword [ebp - 0x588], 0xfffffff7
mov dword [ebp - 0x6b8], 0
jmp 0x473fed
mov eax, dword [ebp - 0x6b8]
inc eax
mov dword [ebp - 0x6b8], eax
cmp dword [ebp - 0x6b8], 3
jge 0x474009
mov eax, dword [ebp - 0x6b8]
mov dword [ebp + eax*4 - 0x250c], 0xfffffff8
jmp 0x473fe0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x250c]
dec eax
mov dword [ebp - 0xed8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xed8]
mov dword [ebp + eax - 0x250c], ecx
cmp dword [ebp - 0xed8], 0
je 0x4740cc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x250c], 0xfffffffb
jne 0x474056
mov dword [ebp - 0x1cf8], 1
jmp 0x47405d
and dword [ebp - 0x1cf8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x250c], 0xd43a1e25
jbe 0x474084
cmp dword [ebp - 0x288], 0
je 0x474084
mov dword [ebp - 0xee0], 1
jmp 0x47408b
and dword [ebp - 0xee0], 0
mov eax, 0xfff6
sub eax, dword [ebp - 0x1cf8]
cmp eax, dword [ebp - 0xee0]
jl 0x4740aa
mov dword [ebp - 0x2494], 1
jmp 0x4740b1
and dword [ebp - 0x2494], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2d98], eax
cmp dword [ebp - 0x3c], 0
je 0x4740cc
mov dword [ebp - 0x16f0], 1
jmp 0x4740d3
and dword [ebp - 0x16f0], 0
cmp dword [ebp - 0x16f0], 0x39807108
jge 0x4740eb
mov dword [ebp - 0xee8], 1
jmp 0x4740f2
and dword [ebp - 0xee8], 0
imul eax, dword [ebp - 0xee8], 0x17b4
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x588], eax
mov dword [ebp - 0x494], 0
jmp 0x474127
mov eax, dword [ebp - 0x494]
dec eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xfffffffc
jge 0x4741b4
mov dword [ebp - 0x588], 0
jmp 0x47414d
mov eax, dword [ebp - 0x588]
dec eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0xfffffff7
jne 0x4741af
mov dword [ebp - 0x288], 0
jmp 0x47416f
cmp dword [ebp - 0x288], 2
jg 0x4741ad
mov byte [ebp - 0x38a], 0
movzx eax, byte [ebp - 0x38a]
test eax, eax
je 0x474199
push 0x1169
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x288]
cmp dword [ebp + eax*4 - 0x250c], 0
je 0x4741ab
jmp 0x474140
jmp 0x47411a
push 1
lea eax, [ebp - 0x35e4]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0046cc15
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3420]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3420]
lea edi, [ebp - 0x2644]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 2
lea ecx, [ebp - 0x3094]
call fcn.004359e4
mov dword [ebp - 0x6c0], 0xa66fe7d8
mov dword [ebp - 0x908], 0
jmp 0x474213
mov eax, dword [ebp - 0x908]
inc eax
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 2
jge 0x474235
push dword [ebp - 0x908]
lea ecx, [ebp - 0x3094]
call fcn.00435ad2
mov dword [eax], 2
jmp 0x474206
mov dword [ebp - 0x6c0], 0
jmp 0x47424e
cmp dword [ebp - 0x6c0], 1
jg 0x4743c6
mov dword [ebp - 0x848], 0xffffffff
mov byte [ebp - 0x24e], 0
movzx eax, byte [ebp - 0x24e]
test eax, eax
je 0x47428d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov dword [ebp - 0x848], 1
jmp 0x4742a6
lea ecx, [ebp - 0x3094]
call fcn.00435ab6
mov dword [ebp - 0x249c], 0x720e
mov dword [ebp - 0x2da0], 0x37831e42
mov dword [ebp - 0x2da8], 0x32bb11ac
mov dword [ebp - 0x2db0], 7
push 1
lea ecx, [ebp - 0x30a4]
call fcn.004359e4
mov dword [ebp - 0xef0], 0x5af8
mov dword [ebp - 0x2db8], 0xffffffff
mov dword [ebp - 0x6d0], 0
jmp 0x474433
cmp dword [ebp - 0x6d0], 1
jge 0x474452
cmp dword [ebp + 8], 1
jne 0x482883
push 2
lea ecx, [ebp - 0x1f00]
call fcn.004359e4
mov dword [ebp - 0x220], 0x667a876e
mov dword [ebp - 0xaf8], 1
mov dword [ebp - 0x2378], 0xcc92ea21
mov dword [ebp - 0x65c], 0
jmp 0x47cc67
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 2
jge 0x47cc89
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x1f00]
call fcn.00435ad2
mov dword [eax], 0xdf99ff60
jmp 0x47cc5a
mov dword [ebp - 0x220], 1
jmp 0x47cca2
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jl 0x47cd9d
mov dword [ebp - 0x664], 0x734f0946
push dword [ebp - 0x220]
lea ecx, [ebp - 0x1f00]
call fcn.00435ad2
push dword [ebp - 0x220]
lea ecx, [ebp - 0x1f00]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jne 0x47cd26
push 1
lea ecx, [ebp - 0x1f00]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0x664], eax
jle 0x47cd26
mov eax, dword [ebp - 0xaf8]
cmp dword [ebp - 0xaf8], eax
jl 0x47cd26
and dword [ebp - 0x1528], 0
jmp 0x47cd30
mov dword [ebp - 0x1528], 1
push dword [ebp - 0x220]
lea ecx, [ebp - 0x1f00]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1528]
cmp ecx, dword [eax]
je 0x47cd57
mov dword [ebp - 0x1c88], 1
jmp 0x47cd5e
and dword [ebp - 0x1c88], 0
push dword [ebp - 0x220]
lea ecx, [ebp - 0x1f00]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1c88]
cmp ecx, dword [eax]
je 0x47cd85
mov dword [ebp - 0x1530], 1
jmp 0x47cd8c
and dword [ebp - 0x1530], 0
mov eax, dword [ebp - 0x1530]
mov dword [ebp - 0x2378], eax
jmp 0x47cc95
lea ecx, [ebp - 0x1f00]
call fcn.00435ab6
mov dword [ebp - 0x5c], 0xe216
mov dword [ebp - 0x310], 0x1e3ff14e
push 3
lea ecx, [ebp - 0x265c]
call fcn.004359e4
mov dword [ebp - 0x219c], 0xc2c6f73
mov dword [ebp - 0x33f8], 0xdee
push 3
lea ecx, [ebp - 0x3184]
call fcn.004359e4
mov dword [ebp - 0x3340], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x47ce01
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x47ce17
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2714], 8
jmp 0x47cdfa
mov dword [ebp - 0xc], 0
jmp 0x47ce27
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x47ce40
push dword [ebp - 0xc]
lea ecx, [ebp - 0x265c]
call fcn.00435ad2
and dword [eax], 0
jmp 0x47ce20
mov dword [ebp - 0xc], 0
jmp 0x47ce50
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x47ce6c
push dword [ebp - 0xc]
lea ecx, [ebp - 0x3184]
call fcn.00435ad2
mov dword [eax], 0x6237ddc4
jmp 0x47ce49
mov dword [ebp - 0xc], 0
jmp 0x47ce7c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x47ce92
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3174], 0xbaf34
jmp 0x47ce75
mov byte [ebp - 0x38f], 0
movzx eax, byte [ebp - 0x38f]
test eax, eax
je 0x47ceb3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3264], eax
cmp dword [ebp - 0x5c], 1
jle 0x47cece
mov dword [ebp - 0x1a18], 1
jmp 0x47ced5
and dword [ebp - 0x1a18], 0
mov eax, dword [ebp - 0x1a18]
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
jae 0x47cef6
mov dword [ebp - 0x1538], 1
jmp 0x47cefd
and dword [ebp - 0x1538], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1538], eax
jle 0x47cf14
mov dword [ebp - 0x1e30], 1
jmp 0x47cf1b
and dword [ebp - 0x1e30], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1e30], eax
je 0x47cf32
mov dword [ebp - 0x1540], 1
jmp 0x47cf39
and dword [ebp - 0x1540], 0
cmp dword [ebp - 0x1540], 3
jge 0x47cf4e
mov dword [ebp - 0x1a20], 1
jmp 0x47cf55
and dword [ebp - 0x1a20], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1a20], eax
je 0x47cf6c
mov dword [ebp - 0x1548], 1
jmp 0x47cf73
and dword [ebp - 0x1548], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1548], eax
jl 0x47cf8a
mov dword [ebp - 0x1c90], 1
jmp 0x47cf91
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1c90], eax
jge 0x47d11f
mov dword [ebp - 0x308], 0xdf9c7750
mov dword [ebp - 0xb88], 1
cmp dword [ebp - 0x308], 0
je 0x47cfd2
mov eax, 0xb0be
test eax, eax
je 0x47cfd2
mov dword [ebp - 0x1550], 1
jmp 0x47cfd9
and dword [ebp - 0x1550], 0
mov eax, dword [ebp - 0x1550]
sub eax, dword [ebp - 0x308]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0x310], 0
jne 0x47d000
mov dword [ebp - 0x1a28], 1
jmp 0x47d007
and dword [ebp - 0x1a28], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x1a28], eax
je 0x47d036
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0xb88], 0
je 0x47d036
mov dword [ebp - 0x1dc8], 1
jmp 0x47d03d
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x308]
add eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x308]
je 0x47d05d
mov dword [ebp - 0x1558], 1
jmp 0x47d064
and dword [ebp - 0x1558], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1558], eax
jl 0x47d07b
mov dword [ebp - 0x1560], 1
jmp 0x47d082
and dword [ebp - 0x1560], 0
mov eax, dword [ebp - 0x1dc8]
cmp eax, dword [ebp - 0x1560]
jne 0x47d09c
mov dword [ebp - 0x1a30], 1
jmp 0x47d0a3
and dword [ebp - 0x1a30], 0
cmp dword [ebp - 0x1a30], 0x3a4c
jl 0x47d0b8
cmp dword [ebp - 0x310], 0
jne 0x47d0c5
xor eax, eax
jne 0x47d0c5
and dword [ebp - 0x1568], 0
jmp 0x47d0cf
mov dword [ebp - 0x1568], 1
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x1568]
je 0x47d102
mov dword [ebp - 0x5c], 0
jmp 0x47d0ea
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x47d100
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2714], 0x64548797
jmp 0x47d0e3
jmp 0x47d11a
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x47d11a
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x47d2b2
mov dword [ebp - 0x674], 0x57b17b4d
mov dword [ebp - 0x9ec], 1
mov dword [ebp - 0x2c60], 0xfffffff6
mov dword [ebp - 0x66c], 0
jmp 0x47d156
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 4
jge 0x47d172
mov eax, dword [ebp - 0x66c]
mov dword [ebp + eax*4 - 0x3630], 0x9c77e219
jmp 0x47d149
cmp dword [ebp - 0x310], 0
je 0x47d190
mov eax, 0xffff
test eax, eax
je 0x47d190
mov dword [ebp - 0xb00], 1
jmp 0x47d197
and dword [ebp - 0xb00], 0
push 1
lea ecx, [ebp - 0x265c]
call fcn.00435ad2
mov ecx, dword [ebp - 0xb00]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x310], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2714]
cmp dword [ebp - 0x310], eax
je 0x47d1d9
mov dword [ebp - 0x1c98], 1
jmp 0x47d1e0
and dword [ebp - 0x1c98], 0
mov eax, dword [ebp - 0x1c98]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
cmp dword [ebp - 0x674], eax
jl 0x47d206
mov dword [ebp - 0x1570], 1
jmp 0x47d20d
and dword [ebp - 0x1570], 0
mov eax, dword [ebp - 0x674]
cmp dword [ebp - 0x1570], eax
jge 0x47d236
push 0
lea ecx, [ebp - 0x265c]
call fcn.00435ad2
cmp dword [eax], 0
jne 0x47d236
and dword [ebp - 0x1a38], 0
jmp 0x47d240
mov dword [ebp - 0x1a38], 1
mov eax, dword [ebp - 0x674]
cmp eax, dword [ebp - 0x1a38]
jle 0x47d25a
mov dword [ebp - 0x1578], 1
jmp 0x47d261
and dword [ebp - 0x1578], 0
mov eax, dword [ebp - 0x674]
cmp eax, dword [ebp - 0x1578]
je 0x47d284
cmp dword [ebp - 0x9ec], 0
je 0x47d284
mov dword [ebp - 0x1ea0], 1
jmp 0x47d28b
and dword [ebp - 0x1ea0], 0
mov eax, dword [ebp - 0x1ea0]
mov dword [ebp - 0x219c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3174]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3174], eax
lea ecx, [ebp - 0x3184]
call fcn.00435ab6
lea ecx, [ebp - 0x265c]
call fcn.00435ab6
push 2
lea ecx, [ebp - 0x1edc]
call fcn.004359e4
mov dword [ebp - 0x200], 0x667a876e
mov dword [ebp - 0x9f4], 1
mov dword [ebp - 0x2560], 0xcc92ea21
mov dword [ebp - 0x67c], 0
jmp 0x47d30c
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 2
jge 0x47d32e
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x1edc]
call fcn.00435ad2
mov dword [eax], 0xdf99ff60
jmp 0x47d2ff
mov dword [ebp - 0x200], 1
jmp 0x47d347
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
jl 0x47d442
mov dword [ebp - 0x684], 0x734f0946
push dword [ebp - 0x200]
lea ecx, [ebp - 0x1edc]
call fcn.00435ad2
push dword [ebp - 0x200]
lea ecx, [ebp - 0x1edc]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0
jne 0x47d3cb
push 1
lea ecx, [ebp - 0x1edc]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x684], eax
jle 0x47d3cb
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x9f4], eax
jl 0x47d3cb
and dword [ebp - 0x1580], 0
jmp 0x47d3d5
mov dword [ebp - 0x1580], 1
push dword [ebp - 0x200]
lea ecx, [ebp - 0x1edc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1580]
cmp ecx, dword [eax]
je 0x47d3fc
mov dword [ebp - 0x1a40], 1
jmp 0x47d403
and dword [ebp - 0x1a40], 0
push dword [ebp - 0x200]
lea ecx, [ebp - 0x1edc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1a40]
cmp ecx, dword [eax]
je 0x47d42a
mov dword [ebp - 0x1588], 1
jmp 0x47d431
and dword [ebp - 0x1588], 0
mov eax, dword [ebp - 0x1588]
mov dword [ebp - 0x2560], eax
jmp 0x47d33a
lea ecx, [ebp - 0x1edc]
call fcn.00435ab6
push 1
lea ecx, [ebp - 0x61c]
call fcn.004359e4
mov dword [ebp - 0x64], 0x3245
mov dword [ebp - 0x4bc], 0xffffffff
push 4
lea ecx, [ebp - 0x1e8c]
call fcn.004359e4
mov dword [ebp - 0x1ca8], 0xd476
mov dword [ebp - 0x21ac], 0x1d66bd5d
mov dword [ebp - 0x68c], 0
jmp 0x47d4a5
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 4
jge 0x47d4c7
push dword [ebp - 0x68c]
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
mov dword [eax], 5
jmp 0x47d498
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2bf0], eax
cmp dword [ebp - 0x64], 0
jne 0x47d567
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2fa8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x2bfc], eax
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x64], eax
jg 0x47d500
mov dword [ebp - 0x1ca0], 1
jmp 0x47d507
and dword [ebp - 0x1ca0], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1ca0], eax
je 0x47d51e
mov dword [ebp - 0x1590], 1
jmp 0x47d525
and dword [ebp - 0x1590], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x1590]
jg 0x47d53c
mov dword [ebp - 0x1a48], 1
jmp 0x47d543
and dword [ebp - 0x1a48], 0
mov eax, dword [ebp - 0x1a48]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3344], eax
cmp dword [ebp - 0x64], 0
jne 0x47d567
and dword [ebp - 0x1598], 0
jmp 0x47d571
mov dword [ebp - 0x1598], 1
cmp dword [ebp - 0x1598], 0
je 0x47d75f
mov dword [ebp - 0x9fc], 0xfffffffd
mov dword [ebp - 0x2380], 0xfffffffd
mov dword [ebp - 0x694], 0
jmp 0x47d5ab
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 1
jge 0x47d5c7
mov eax, dword [ebp - 0x694]
mov dword [ebp + eax*4 - 0x21a4], 1
jmp 0x47d59e
mov dword [ebp - 0x4bc], 0xfffffff7
jmp 0x47d5e0
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0xfffffff8
jge 0x47d61a
mov dword [ebp - 0x1dd0], 0x68593f9b
mov dword [ebp - 0x64], 0
jmp 0x47d603
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 5
jg 0x47d618
mov eax, dword [ebp - 0x1dd0]
dec eax
mov dword [ebp - 0x1dd0], eax
jmp 0x47d5fc
jmp 0x47d5d3
push 2
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
cmp dword [eax], 0x4bb489f7
jne 0x47d63b
mov dword [ebp - 0x15b0], 1
jmp 0x47d642
and dword [ebp - 0x15b0], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x2c08], eax
mov eax, 0x2500428
test eax, eax
jne 0x47d664
push 0
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
push 7
pop eax
cmp eax, 1
jb 0x47d678
mov dword [ebp - 0x15a0], 1
jmp 0x47d67f
and dword [ebp - 0x15a0], 0
mov eax, dword [ebp - 0x9fc]
cmp dword [ebp - 0x15a0], eax
jl 0x47d699
mov dword [ebp - 0x1a50], 1
jmp 0x47d6a0
and dword [ebp - 0x1a50], 0
imul esi, dword [ebp - 0x1a50], 0x3eaa
push 3
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
cmp esi, dword [eax]
jg 0x47d6c7
mov dword [ebp - 0x15a8], 1
jmp 0x47d6ce
and dword [ebp - 0x15a8], 0
mov eax, dword [ebp - 0x9fc]
cmp dword [ebp - 0x15a8], eax
je 0x47d6e8
mov dword [ebp - 0xa04], 1
jmp 0x47d6ef
and dword [ebp - 0xa04], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa04]
mov dword [ebp + eax - 0x21a4], ecx
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x1ca8], eax
cmp dword [ebp - 0x1ca8], 1
jb 0x47d71e
cmp dword [ebp - 0x2380], 0
push 0
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
mov ecx, dword [ebp - 0x15b0]
cmp ecx, dword [eax]
jle 0x47d741
mov dword [ebp - 0x1a58], 1
jmp 0x47d748
and dword [ebp - 0x1a58], 0
push 0
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1a58]
mov dword [eax], ecx
jmp 0x47d7af
mov byte [ebp - 0x391], 0
movzx eax, byte [ebp - 0x391]
test eax, eax
je 0x47d79a
push 0x7be
push 0
push 0
push 0x1df6
push 0x127d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov esi, dword [ebp - 0x21ac]
push 0
lea ecx, [ebp - 0x1e8c]
call fcn.00435ad2
mov dword [eax], esi
lea ecx, [ebp - 0x1e8c]
call fcn.00435ab6
mov dword [ebp - 0x28], 0x4896
push 3
lea ecx, [ebp - 0x3194]
call fcn.004359e4
push 4
lea ecx, [ebp - 0x1fa8]
call fcn.004359e4
mov dword [ebp - 0x15c0], 0
mov dword [ebp - 0x2fb0], 0x40194ddb
mov dword [ebp - 0x2c14], 1
mov dword [ebp - 0x326c], 7
mov dword [ebp - 0x2c20], 0xffffffff
mov dword [ebp - 0x1e40], 0xfffffff6
mov dword [ebp - 0xfc], 0
jmp 0x47d830
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x47d852
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x3194]
call fcn.00435ad2
mov dword [eax], 0xe48d
jmp 0x47d823
mov dword [ebp - 0xfc], 0
jmp 0x47d86b
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x47d88d
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x1fa8]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x47d85e
push 1
lea ecx, [ebp - 0x1fa8]
call fcn.00435ad2
and dword [eax], 0
jmp 0x47d8c3
push 1
lea ecx, [ebp - 0x1fa8]
call fcn.00435ad2
mov dword [ebp - 0x15b8], eax
mov eax, dword [ebp - 0x15b8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x15b8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1fa8]
call fcn.00435ad2
cmp dword [eax], 2
jg 0x47d903
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x47d8f4
push 0x1f74
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov eax, dword [ebp - 0x1e40]
inc eax
mov dword [ebp - 0x1e40], eax
jmp 0x47d89f
mov eax, dword [ebp - 0x15c0]
mov dword [ebp - 0x2fb8], eax
push 1
lea ecx, [ebp - 0x1fa8]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x15c0], eax
lea ecx, [ebp - 0x1fa8]
call fcn.00435ab6
lea ecx, [ebp - 0x3194]
call fcn.00435ab6
mov dword [ebp - 0xa2c], 0x6928694a
push 2
lea ecx, [ebp - 0x2a98]
call fcn.004359e4
mov dword [ebp - 0x6a4], 5
mov dword [ebp - 0x69c], 0
jmp 0x47d974
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 2
jge 0x47d996
push dword [ebp - 0x69c]
lea ecx, [ebp - 0x2a98]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x47d967
mov dword [ebp - 0x6a4], 1
jmp 0x47d9af
mov eax, dword [ebp - 0x6a4]
dec eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0
jl 0x47d9ce
push 1
lea ecx, [ebp - 0x2a98]
call fcn.00435ad2
cmp dword [eax], 0
je 0x47d9cc
jmp 0x47d9ce
jmp 0x47d9a2
lea ecx, [ebp - 0x2a98]
call fcn.00435ab6
mov dword [ebp - 0xefc], 0xffffffff
mov dword [ebp - 0x20], 0xb7c7008b
mov dword [ebp - 0x6bc], 0x42e40c18
mov dword [ebp - 0x318], 0xfffffffc
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x3d8], 0xfffc
push 2
lea ecx, [ebp - 0xbf8]
call fcn.004359e4
mov dword [ebp - 0x620], 0
jmp 0x47da38
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 2
jge 0x47da5a
push dword [ebp - 0x620]
lea ecx, [ebp - 0xbf8]
call fcn.00435ad2
mov dword [eax], 0xfffffffc
jmp 0x47da2b
xor eax, eax
jne 0x47dbb2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3348], eax
cmp dword [ebp - 0x20], 0
je 0x47da8c
cmp dword [ebp - 0x20], 0
je 0x47da8c
mov dword [ebp - 0x1a60], 1
jmp 0x47da93
and dword [ebp - 0x1a60], 0
mov eax, dword [ebp - 0x1a60]
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 0xffffffff
jg 0x47dab4
mov dword [ebp - 0x15c8], 1
jmp 0x47dabb
and dword [ebp - 0x15c8], 0
mov dword [ebp - 0x318], 1
cmp dword [ebp - 0x318], 0xe11
jl 0x47dadd
mov dword [ebp - 0x1cb0], 1
jmp 0x47dae4
and dword [ebp - 0x1cb0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1cb0], eax
je 0x47dafb
mov dword [ebp - 0x15d0], 1
jmp 0x47db02
and dword [ebp - 0x15d0], 0
cmp dword [ebp - 0x15d0], 0xfffffffc
jge 0x47db19
or eax, 0xffffffff
jne 0x47db19
and dword [ebp - 0x1a68], 0
jmp 0x47db23
mov dword [ebp - 0x1a68], 1
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x1a68], eax
jl 0x47db3d
mov dword [ebp - 0x15d8], 1
jmp 0x47db44
and dword [ebp - 0x15d8], 0
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x15d8], eax
jg 0x47db5e
mov dword [ebp - 0x1dd8], 1
jmp 0x47db65
and dword [ebp - 0x1dd8], 0
mov eax, dword [ebp - 0x1dd8]
sub eax, dword [ebp - 0x6ac]
cmp eax, dword [ebp - 0x3d8]
je 0x47db8e
mov dword [ebp - 0x1a70], 1
push 1
lea ecx, [ebp - 0xbf8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1a70]
mov dword [eax], ecx
mov dword [ebp - 0x318], 0
jmp 0x47dbea
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xffffffea
jg 0x47e064
mov dword [ebp - 0x4c4], 0xffff
mov byte [ebp - 0x393], 0
movzx eax, byte [ebp - 0x393]
test eax, eax
je 0x47dc22
push 0
push 0xb58
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
mov dword [ebp - 0x3d8], 0
jmp 0x47dc3b
cmp dword [ebp - 0x3d8], 0x2e
je 0x47e05f
push 3
lea ecx, [ebp - 0xc10]
call fcn.004359e4
mov dword [ebp - 0x1610], 1
mov dword [ebp - 0x6b4], 0
jmp 0x47dc78
cmp dword [ebp - 0x6b4], 3
jge 0x47dc9a
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0xc10]
call fcn.00435ad2
mov dword [eax], 0xe7c0ce69
jmp 0x47dc6b
mov dword [ebp - 0x20], 0
jmp 0x47dcaa
jmp 0x47dbdd
lea ecx, [ebp - 0xbf8]
call fcn.00435ab6
mov dword [ebp - 0x320], 0xffffffff
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x47e09a
push 0
push 0x227
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x320], 8
jmp 0x47e0b3
cmp dword [ebp - 0x320], 5
je 0x47e194
mov dword [ebp - 0x1d8], 0
mov eax, 0x7e5c285c
test eax, eax
je 0x47e135
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x320], eax
jne 0x47e0ed
mov dword [ebp - 0x1a88], 1
jmp 0x47e0f4
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x1a88], eax
je 0x47e10e
and dword [ebp - 0x1de0], 0
cmp dword [ebp - 0x1de0], 0xfffffff8
jne 0x47e151
mov dword [ebp - 0x1620], 1
jmp 0x47e158
and dword [ebp - 0x1620], 0
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x1620]
sub edx, dword [ebp - 0x1d8]
imul edx, dword [ebp - 0x1d8]
imul edx, dword [ebp - 0x320]
imul edx, edx, 0x1145
imul ecx, edx
add eax, ecx
mov dword [ebp - 0x1d8], eax
jmp 0x47e0a6
mov dword [ebp - 0x6cc], 0
jmp 0x47e1ad
cmp dword [ebp - 0x6cc], 1
jge 0x47e1cc
push dword [ebp - 0x6cc]
lea ecx, [ebp - 0x61c]
call fcn.00435ad2
or dword [eax], 0xffffffff
jmp 0x47e1a0
mov dword [ebp - 0x4b4], 0xfffffffb
mov dword [ebp - 0x3274], 0
mov dword [ebp - 0x6d4], 0
jmp 0x47e1f9
and dword [ebp - 0x2880], 0
and dword [ebp - 0x287c], 0
and dword [ebp - 0x2878], 0
and dword [ebp - 0x2874], 0
lea ecx, [ebp - 0xba1]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x2870]
push eax
lea eax, [ebp - 0x2880]
push eax
lea ecx, [ebp - 0x3588]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x342c]
call fcn.00435a90
mov dword [ebp - 0x7dc], 0
jmp 0x4828ed
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 2
jge 0x482909
mov eax, dword [ebp - 0x7dc]
mov dword [ebp + eax*4 - 0x1f34], 0xe0648261
jmp 0x4828e0
mov byte [ebp - 0x231], 0
movzx eax, byte [ebp - 0x231]
test eax, eax
je 0x482936
push 0
push 0x6aa
push 0x2359
push 0x12b6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f34], 0
jmp 0x482964
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f34]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f34], 0xffffffeb
jle 0x4829f8
mov dword [ebp - 0x7e4], 0
mov dword [ebp - 0x7e4], 3
jmp 0x48299b
mov eax, dword [ebp - 0x7e4]
dec eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0
jl 0x4829d4
mov byte [ebp - 0x233], 0
movzx eax, byte [ebp - 0x233]
test eax, eax
je 0x4829d2
push 0x19e4
push 0x15ac
push 0x1534
push 0x10e2
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x48298e
mov byte [ebp - 0x235], 0
movzx eax, byte [ebp - 0x235]
test eax, eax
je 0x4829f3
push 0x1f74
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x482949
lea ecx, [ebp - 0x342c]
call fcn.00435ab6
mov dword [ebp - 0x28a8], 0x3df75dce
mov dword [ebp - 0x28a4], 0x3df75dce
mov dword [ebp - 0x28a0], 0x3df75dce
mov dword [ebp - 0x289c], 0x3df75dce
lea ecx, [ebp - 0xba9]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x2898]
push eax
lea eax, [ebp - 0x28a8]
push eax
lea ecx, [ebp - 0x3548]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a5c]
call fcn.00435a90
mov dword [ebp - 0x420], 0x5ccc90a3
mov dword [ebp - 0x13b4], 0xfcc9
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x13cc], 0x532d49ac
mov dword [ebp - 0x13d4], 0xfffffff9
mov dword [ebp - 0x13dc], 0x1241a59c
mov dword [ebp - 0x140c], 0xe324e816
mov dword [ebp - 0x2048], 0
mov dword [ebp - 0x420], 0
jmp 0x482ac9
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 3
jg 0x482f60
mov dword [ebp - 0x52c], 0x32937a3a
mov dword [ebp - 0x13e4], 0xfffc
mov dword [ebp - 0x2bc8], 1
mov dword [ebp - 0x2bc4], 1
mov dword [ebp - 0x2bc0], 1
mov dword [ebp - 0x2bbc], 1
mov dword [ebp - 0xa84], 0xffffffff
mov dword [ebp - 0x52c], 3
jmp 0x482b35
mov eax, dword [ebp - 0x52c]
dec eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 0
jl 0x482f5b
mov dword [ebp - 0x534], 0x6715f0ed
mov dword [ebp - 0x141c], 4
mov dword [ebp - 0x534], 0
jmp 0x482b6f
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 3
jg 0x482f2b
mov dword [ebp - 0x428], 0x98e64e6d
mov dword [ebp - 0x428], 3
jmp 0x482b9f
mov eax, dword [ebp - 0x428]
dec eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jl 0x482f07
mov dword [ebp - 0x25bc], 3
mov dword [ebp - 0x25b8], 3
mov dword [ebp - 0x25b4], 3
mov dword [ebp - 0x25b0], 3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x25bc], 0
je 0x482bf8
cmp dword [ebp - 0x52c], 0
je 0x482bf8
mov dword [ebp - 0x139c], 1
jmp 0x482bff
and dword [ebp - 0x139c], 0
cmp dword [ebp - 0x139c], 0x5d7c
jne 0x482c17
mov dword [ebp - 0x13a4], 1
jmp 0x482c1e
and dword [ebp - 0x13a4], 0
mov eax, dword [ebp - 0x13e4]
cmp eax, dword [ebp - 0x13a4]
je 0x482c38
mov dword [ebp - 0x13ac], 1
jmp 0x482c3f
and dword [ebp - 0x13ac], 0
mov eax, dword [ebp - 0x534]
imul eax, dword [ebp - 0x13ac]
add eax, dword [ebp - 0x13b4]
mov dword [ebp - 0x430], eax
jne 0x482c66
mov dword [ebp - 0x13bc], 1
jmp 0x482c6d
and dword [ebp - 0x13bc], 0
mov eax, dword [ebp - 0x13b4]
cmp dword [ebp - 0x13bc], eax
jle 0x482c87
mov dword [ebp - 0x13c4], 1
jmp 0x482c8e
and dword [ebp - 0x13c4], 0
mov eax, dword [ebp - 0x13c4]
mov dword [ebp - 0x13cc], eax
mov eax, dword [ebp - 0x13cc]
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x13d4]
mov dword [ebp - 0x13dc], eax
cmp dword [ebp - 0x13dc], 0x6f4e
jge 0x482cca
mov dword [ebp - 0x13ec], 1
jmp 0x482cd1
and dword [ebp - 0x13ec], 0
mov eax, dword [ebp - 0x13e4]
cmp eax, dword [ebp - 0x13ec]
je 0x482ceb
mov dword [ebp - 0x13f4], 1
jmp 0x482cf2
and dword [ebp - 0x13f4], 0
cmp dword [ebp - 0x13f4], 0xfffffffe
jl 0x482d07
mov dword [ebp - 0x13fc], 1
jmp 0x482d0e
and dword [ebp - 0x13fc], 0
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x13fc], eax
jne 0x482d28
mov dword [ebp - 0xa7c], 1
jmp 0x482d2f
and dword [ebp - 0xa7c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xa7c]
mov dword [ebp + eax - 0x2bc8], ecx
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0x141c]
cmp dword [ebp - 0xa84], eax
jl 0x482d68
mov dword [ebp - 0x1404], 1
jmp 0x482d6f
and dword [ebp - 0x1404], 0
push dword [ebp - 0x428]
lea ecx, [ebp - 0x2a5c]
call fcn.00435ad2
mov dword [ebp - 0x1414], eax
push dword [ebp - 0x420]
lea ecx, [ebp - 0x2a5c]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1414]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1404]
mov dword [ebp - 0x140c], eax
mov eax, dword [ebp - 0x140c]
mov ecx, dword [ebp - 0x1414]
cmp dword [ecx], eax
jne 0x482dcf
mov eax, 0x7187
test eax, eax
jne 0x482dcf
and dword [ebp - 0x1424], 0
jmp 0x482dd9
mov dword [ebp - 0x1424], 1
mov eax, dword [ebp - 0x141c]
cmp dword [ebp - 0x1424], eax
jne 0x482df3
mov dword [ebp - 0x142c], 1
jmp 0x482dfa
and dword [ebp - 0x142c], 0
mov eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x142c]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x25bc]
je 0x482e20
mov dword [ebp - 0x1434], 1
jmp 0x482e27
and dword [ebp - 0x1434], 0
cmp dword [ebp - 0x1434], 0xed52
je 0x482e3f
mov dword [ebp - 0x143c], 1
jmp 0x482e46
and dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x2048]
cmp dword [ebp - 0x143c], eax
jg 0x482e60
mov dword [ebp - 0x1444], 1
jmp 0x482e67
and dword [ebp - 0x1444], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x25bc]
cmp dword [ebp - 0x1444], eax
je 0x482eba
xor eax, eax
inc eax
je 0x482eba
mov dword [ebp - 0x430], 0
jmp 0x482e99
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0x39
je 0x482eb8
mov dword [ebp - 0x2050], 0xe255
mov dword [ebp - 0x2050], 0xfffffffe
jmp 0x482e8c
jmp 0x482ef4
mov byte [ebp - 0x237], 0
movzx eax, byte [ebp - 0x237]
test eax, eax
je 0x482ef4
push 0
push 0xfce
push 0x20f4
push 0x954
push 0x2458
push 0x1a56
push 0x170b
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [ebp - 0xa84], 0
je 0x482f02
jmp 0x482b92
jmp 0x482b92
mov byte [ebp - 0x239], 0
movzx eax, byte [ebp - 0x239]
test eax, eax
je 0x482f26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x482b62
mov byte [ebp - 0x23b], 0
movzx eax, byte [ebp - 0x23b]
test eax, eax
je 0x482f56
push 0x1d9a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x482b28
jmp 0x482abc
lea ecx, [ebp - 0x2a5c]
call fcn.00435ab6
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x358], 0xbef9f3b0
mov dword [ebp - 0x438], 1
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xa756a336
jae 0x482fa2
mov dword [ebp - 0x144c], 1
jmp 0x482fa9
and dword [ebp - 0x144c], 0
cmp dword [ebp - 0x40], 1
je 0x482fbb
mov dword [ebp - 0x1454], 1
jmp 0x482fc2
and dword [ebp - 0x1454], 0
mov eax, dword [ebp - 0x144c]
cmp eax, dword [ebp - 0x1454]
jne 0x482fdc
mov dword [ebp - 0x145c], 1
jmp 0x482fe3
and dword [ebp - 0x145c], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x145c]
neg eax
add eax, 0x4b370f30
je 0x483224
mov dword [ebp - 0x1494], 6
mov dword [ebp - 0xf8], 0
jmp 0x48301d
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x483039
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x9d4], 0x36de
jmp 0x483010
mov dword [ebp - 0xf8], 0
jmp 0x483052
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x48306e
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x2c1c], 1
jmp 0x483045
mov dword [ebp - 0x40], 0
jmp 0x48307e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x4831e5
mov dword [ebp - 0x146c], 0x955205
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x9d4]
mov dword [ebp - 0x2d9c], eax
cmp dword [ebp - 0x40], 0
je 0x483156
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x9d4]
mov dword [ebp - 0x33e0], eax
xor eax, eax
jne 0x4830ce
xor eax, eax
inc eax
jne 0x4830ce
and dword [ebp - 0x1464], 0
jmp 0x4830d8
mov dword [ebp - 0x1464], 1
mov eax, dword [ebp - 0x1464]
mov dword [ebp - 0x146c], eax
mov eax, dword [ebp - 0x146c]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x9d4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x9d4]
jge 0x483112
mov dword [ebp - 0x1474], 1
jmp 0x483119
and dword [ebp - 0x1474], 0
cmp dword [ebp - 0x1474], 1
jg 0x48312e
mov dword [ebp - 0x147c], 1
jmp 0x483135
and dword [ebp - 0x147c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9d4]
add eax, dword [ebp - 0x147c]
je 0x483156
mov dword [ebp - 0x1484], 1
jmp 0x48315d
and dword [ebp - 0x1484], 0
mov eax, dword [ebp - 0x1484]
neg eax
mov ecx, dword [ebp - 0x40]
cmp eax, dword [ebp + ecx*4 - 0x9d4]
jg 0x48317d
mov dword [ebp - 0x148c], 1
jmp 0x483184
and dword [ebp - 0x148c], 0
mov eax, dword [ebp - 0x148c]
mov dword [ebp - 0x1494], eax
mov eax, dword [ebp - 0x1494]
mov ecx, dword [ebp - 0x40]
imul eax, dword [ebp + ecx*4 - 0x9d4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x9d4]
jge 0x4831bc
mov dword [ebp - 0x2058], 1
jmp 0x4831c3
and dword [ebp - 0x2058], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x2da4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c1c], 0xe96bb645
jmp 0x483077
mov byte [ebp - 0x23d], 0
movzx eax, byte [ebp - 0x23d]
test eax, eax
je 0x48321f
push 0x115
push 0x2525
push 0x12f6
push 0x198
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x48340e
mov dword [ebp - 0x53c], 0xfffffff7
mov dword [ebp - 0x7ec], 0
jmp 0x483247
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 3
jge 0x483263
mov eax, dword [ebp - 0x7ec]
mov dword [ebp + eax*4 - 0x256c], 0xfffffff8
jmp 0x48323a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x256c]
dec eax
mov dword [ebp - 0x149c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x149c]
mov dword [ebp + eax - 0x256c], ecx
cmp dword [ebp - 0x149c], 0
je 0x483326
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x256c], 0xfffffffb
jne 0x4832b0
mov dword [ebp - 0x14a4], 1
jmp 0x4832b7
and dword [ebp - 0x14a4], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x256c], 0xd43a1e25
jbe 0x4832de
cmp dword [ebp - 0x358], 0
je 0x4832de
mov dword [ebp - 0x14ac], 1
jmp 0x4832e5
and dword [ebp - 0x14ac], 0
mov eax, 0xfff6
sub eax, dword [ebp - 0x14a4]
cmp eax, dword [ebp - 0x14ac]
jl 0x483304
mov dword [ebp - 0x2060], 1
jmp 0x48330b
and dword [ebp - 0x2060], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x3078], eax
cmp dword [ebp - 0x40], 0
je 0x483326
mov dword [ebp - 0x14b4], 1
jmp 0x48332d
and dword [ebp - 0x14b4], 0
cmp dword [ebp - 0x14b4], 0x39807108
jge 0x483345
mov dword [ebp - 0x14bc], 1
jmp 0x48334c
and dword [ebp - 0x14bc], 0
imul eax, dword [ebp - 0x14bc], 0x17b4
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x438], 0
jmp 0x483381
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0xfffffffc
jge 0x48340e
mov dword [ebp - 0x53c], 0
jmp 0x4833a7
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0xfffffff7
jne 0x483409
mov dword [ebp - 0x358], 0
jmp 0x4833c9
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 2
jg 0x483407
mov byte [ebp - 0x23f], 0
movzx eax, byte [ebp - 0x23f]
test eax, eax
je 0x4833f3
push 0x1169
push 0
push 0
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [ebp - 0x358]
cmp dword [ebp + eax*4 - 0x256c], 0
je 0x483405
jmp 0x483407
jmp 0x4833bc
jmp 0x48339a
jmp 0x483374
mov dword [ebp - 0x15c4], 0xffffffff
mov dword [ebp - 0xe0], 0x4e064826
mov dword [ebp - 0x14e4], 0x4f9a0237
mov dword [ebp - 0x544], 0xebbfad0d
mov dword [ebp - 0x2dac], 0x76ac116e
mov dword [ebp - 0xe0], 0
jmp 0x483459
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffffd
je 0x4835cf
mov dword [ebp - 0xa94], 0xffff
mov dword [ebp - 0xa8c], 0xf12f3ccd
mov dword [ebp - 0x7f4], 0xffffffff
mov dword [ebp - 0x2078], 0x90f3bd79
cmp dword [ebp - 0xa94], 0
je 0x483542
xor eax, eax
jne 0x4834b4
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0xa8c], 0
je 0x4834c9
cmp dword [ebp - 0xe0], 0
je 0x4834c9
mov dword [ebp - 0x14c4], 1
jmp 0x4834d0
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0xa94]
imul eax, dword [ebp - 0x14c4]
test eax, eax
jne 0x4834f3
cmp dword [ebp - 0xa8c], 0
jne 0x4834f3
and dword [ebp - 0x14cc], 0
jmp 0x4834fd
mov dword [ebp - 0x14cc], 1
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x14cc], eax
jne 0x483517
mov dword [ebp - 0x2068], 1
jmp 0x48351e
and dword [ebp - 0x2068], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x32cc], eax
mov eax, 0xf3d3
cmp eax, 0xa14c
jge 0x483542
mov dword [ebp - 0x14d4], 1
jmp 0x483549
and dword [ebp - 0x14d4], 0
mov eax, dword [ebp - 0x7f4]
add eax, dword [ebp - 0x14d4]
add eax, dword [ebp - 0xa94]
jne 0x48356f
cmp dword [ebp - 0xe0], 0
jne 0x48356f
and dword [ebp - 0x14dc], 0
jmp 0x483579
mov dword [ebp - 0x14dc], 1
mov eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x14e4], eax
mov eax, dword [ebp - 0x7f4]
cmp dword [ebp - 0x14e4], eax
je 0x48359f
mov dword [ebp - 0x2070], 1
jmp 0x4835a6
and dword [ebp - 0x2070], 0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x2db4], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x2078], eax
jmp 0x48344c
mov dword [ebp - 0x544], 0
jmp 0x4835e8
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0x10
jle 0x48360d
mov byte [ebp - 0x241], 0
movzx eax, byte [ebp - 0x241]
test eax, eax
je 0x48360b
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
jmp 0x4835db
mov dword [ebp - 0x19c], 0x457102d1
mov dword [ebp - 0x804], 0x5d6c05ba
mov dword [ebp - 0x7fc], 0
jmp 0x48363a
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 2
jge 0x483656
mov eax, dword [ebp - 0x7fc]
mov dword [ebp + eax*4 - 0x35d0], 6
jmp 0x48362d
mov dword [ebp - 0x804], 6
jmp 0x48366f
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0x15
je 0x48369a
mov dword [ebp - 0x2080], 0x4dd03248
mov dword [ebp - 0x2088], 0xfffffff6
mov eax, dword [ebp - 0x2080]
mov dword [ebp - 0x2088], eax
jmp 0x483662
mov dword [ebp - 0x17f4], 0xffffffff
mov dword [ebp - 0x54c], 0x837bc752
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x80c], 0
jmp 0x4836d1
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 1
jge 0x4836ed
mov eax, dword [ebp - 0x80c]
mov dword [ebp + eax*4 - 0x164], 9
jmp 0x4836c4
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x164]
mov dword [ebp + ecx - 0x164], eax
mov dword [ebp - 0x54c], 0x14
jmp 0x483720
mov eax, dword [ebp - 0x54c]
inc eax
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0x1c
jle 0x483be3
mov dword [ebp - 0x78], 0xca2961c0
mov dword [ebp - 0x440], 0x58fb5c4c
mov dword [ebp - 0x20a8], 0
mov dword [ebp - 0x78], 0
jmp 0x483758
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffff6
jle 0x483a0b
mov dword [ebp - 0x360], 0x9c4185a1
mov dword [ebp - 0x1514], 0xcd953295
cmp dword [ebp - 0x54c], 0
je 0x483784
jmp 0x483a0b
mov dword [ebp - 0x360], 0xfffffff4
jmp 0x48379d
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xfffffff7
jle 0x483a06
mov dword [ebp - 0x20a0], 0xc005d9c7
mov dword [ebp - 0x1504], 0x2967684a
mov dword [ebp - 0x814], 0
jmp 0x4837d7
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 4
jge 0x4837f3
mov eax, dword [ebp - 0x814]
mov dword [ebp + eax*4 - 0x2034], 0
jmp 0x4837ca
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2034], 0xc
jmp 0x483821
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2034]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2034], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2034], 0x15
jg 0x4839cc
mov dword [ebp - 0x2098], 0xb3f4b141
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x360], eax
jne 0x48393f
mov eax, 0x8064
test eax, eax
je 0x48393f
cmp dword [ebp - 0x78], 0xfff6
jne 0x483873
mov dword [ebp - 0x14ec], 1
jmp 0x48387a
and dword [ebp - 0x14ec], 0
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x14ec], eax
jg 0x483894
mov dword [ebp - 0x2090], 1
jmp 0x48389b
and dword [ebp - 0x2090], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3088], eax
mov eax, dword [ebp - 0x2098]
mov dword [ebp - 0x2dbc], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x4838c9
cmp dword [ebp - 0x360], 0
jne 0x4838c9
and dword [ebp - 0x14f4], 0
jmp 0x4838d3
mov dword [ebp - 0x14f4], 1
cmp dword [ebp - 0x14f4], 8
jg 0x4838f8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2034], 0
je 0x4838f8
mov dword [ebp - 0x14fc], 1
jmp 0x4838ff
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x14fc]
mov dword [ebp - 0x20a0], eax
mov eax, dword [ebp - 0x1514]
mov dword [ebp - 0x3378], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
mov dword [ebp - 0x1504], eax
cmp dword [ebp - 0x1504], 0
je 0x48393f
mov dword [ebp - 0x150c], 1
jmp 0x483946
and dword [ebp - 0x150c], 0
cmp dword [ebp - 0x150c], 0xa644184
jne 0x48395e
mov dword [ebp - 0x151c], 1
jmp 0x483965
and dword [ebp - 0x151c], 0
mov eax, dword [ebp - 0x1514]
cmp dword [ebp - 0x151c], eax
jg 0x48397f
mov dword [ebp - 0x1524], 1
jmp 0x483986
and dword [ebp - 0x1524], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
cmp eax, dword [ebp - 0x1524]
jg 0x4839a7
mov dword [ebp - 0x152c], 1
jmp 0x4839ae
and dword [ebp - 0x152c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2034]
imul eax, dword [ebp - 0x152c]
mov dword [ebp - 0x440], eax
jmp 0x483806
mov dword [ebp - 0x15c], 0
jmp 0x4839e5
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 4
jge 0x483a01
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x2034], 0xf2b78262
jmp 0x4839d8
jmp 0x483790
jmp 0x483751
cmp dword [ebp - 0x15c], 0
jne 0x483b85
cmp dword [ebp - 0x440], 0x1fdf
jle 0x483a30
mov dword [ebp - 0x1554], 1
jmp 0x483a37
and dword [ebp - 0x1554], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x2dc4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x164]
cmp dword [ebp + eax - 0x164], ecx
jne 0x483a6b
mov dword [ebp - 0x1534], 1
jmp 0x483a72
and dword [ebp - 0x1534], 0
imul eax, dword [ebp - 0x1534], 0xcceb
cmp eax, dword [ebp - 0x440]
jg 0x483a90
mov dword [ebp - 0x153c], 1
jmp 0x483a97
and dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x153c], eax
jl 0x483aae
mov dword [ebp - 0x1544], 1
jmp 0x483ab5
and dword [ebp - 0x1544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
cmp dword [ebp - 0x1544], eax
jl 0x483ad6
mov dword [ebp - 0x154c], 1
jmp 0x483add
and dword [ebp - 0x154c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x154c], eax
je 0x483af7
mov dword [ebp - 0x155c], 1
jmp 0x483afe
and dword [ebp - 0x155c], 0
mov eax, dword [ebp - 0x1554]
cmp eax, dword [ebp - 0x155c]
jl 0x483b18
mov dword [ebp - 0x1564], 1
jmp 0x483b1f
and dword [ebp - 0x1564], 0
cmp dword [ebp - 0x1564], 0x6240
jg 0x483b3d
cmp dword [ebp - 0x15c], 0
jne 0x483b3d
and dword [ebp - 0x156c], 0
jmp 0x483b47
mov dword [ebp - 0x156c], 1
mov eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x156c]
jge 0x483b61
mov dword [ebp - 0x1574], 1
jmp 0x483b68
and dword [ebp - 0x1574], 0
mov eax, dword [ebp - 0x440]
add eax, dword [ebp - 0x1574]
sub eax, dword [ebp - 0x20a8]
jne 0x483b85
and dword [ebp - 0x157c], 0
jmp 0x483b8f
mov dword [ebp - 0x157c], 1
cmp dword [ebp - 0x157c], 1
jl 0x483bc6
mov dword [ebp - 0x78], 0
jmp 0x483ba8
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x483bc4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x164]
mov dword [ebp + ecx*4 - 0x164], eax
jmp 0x483ba1
jmp 0x483bde
mov byte [ebp - 0x243], 0
movzx eax, byte [ebp - 0x243]
test eax, eax
je 0x483bde
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x483713
mov dword [ebp - 0x1824], 7
cmp dword [ebp - 0x15c4], 0
je 0x4846df
mov dword [ebp - 0x2ba8], 0
mov dword [ebp - 0x2ba4], 0
mov dword [ebp - 0x2ba0], 0
mov dword [ebp - 0x2b9c], 0
mov dword [ebp - 0x81c], 0xffffffff
mov dword [ebp - 0x16c], 0
jmp 0x483c45
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x483c61
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x1ef4], 0xf415d724
jmp 0x483c38
mov dword [ebp - 0x16c], 0
jmp 0x483c7a
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x483c96
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x2c28], 0xffffffff
jmp 0x483c6d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1ef4], 0xffffffff
jbe 0x483cb2
mov dword [ebp - 0x1584], 1
jmp 0x483cb9
and dword [ebp - 0x1584], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ef4]
cmp dword [ebp - 0x1584], eax
jle 0x483cda
mov dword [ebp - 0x158c], 1
jmp 0x483ce1
and dword [ebp - 0x158c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ef4]
cmp dword [ebp - 0x158c], eax
jle 0x483d02
mov dword [ebp - 0x1594], 1
jmp 0x483d09
and dword [ebp - 0x1594], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ef4]
cmp dword [ebp - 0x1594], eax
jne 0x483d2a
mov dword [ebp - 0x20b0], 1
jmp 0x483d31
and dword [ebp - 0x20b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ef4]
mov dword [ebp - 0x3098], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1ef4], 1
jg 0x483d60
mov dword [ebp - 0x159c], 1
jmp 0x483d67
and dword [ebp - 0x159c], 0
cmp dword [ebp - 0x159c], 0x912530a9
ja 0x483d7f
mov dword [ebp - 0xa9c], 1
jmp 0x483d86
and dword [ebp - 0xa9c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa9c]
mov dword [ebp + eax - 0x2c28], ecx
cmp dword [ebp - 0xa9c], 0
jl 0x483dae
mov dword [ebp - 0x15a4], 1
jmp 0x483db5
and dword [ebp - 0x15a4], 0
cmp dword [ebp - 0x15a4], 0
je 0x483dd3
mov eax, 0x2717
test eax, eax
je 0x483dd3
mov dword [ebp - 0x15ac], 1
jmp 0x483dda
and dword [ebp - 0x15ac], 0
cmp dword [ebp - 0x15ac], 0xffffffff
jne 0x483def
mov dword [ebp - 0x15b4], 1
jmp 0x483df6
and dword [ebp - 0x15b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ef4]
cmp dword [ebp - 0x15b4], eax
jne 0x483e17
mov dword [ebp - 0x15bc], 1
jmp 0x483e1e
and dword [ebp - 0x15bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x15bc]
mov dword [ebp + eax - 0x2ba8], ecx
mov dword [ebp - 0x81c], 0
jmp 0x483e49
mov eax, dword [ebp - 0x81c]
inc eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 3
jg 0x483e6c
mov byte [ebp - 0x245], 0
movzx eax, byte [ebp - 0x245]
test eax, eax
je 0x483e6a
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
jmp 0x483e3c
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 4], 0x22263126
mov dword [ebp - 0x448], 0xfffffffe
mov dword [ebp - 0x1654], 0
mov dword [ebp - 0x1664], 0xbbe0
mov dword [ebp - 0x168c], 4
push 2
lea ecx, [ebp - 0x31f4]
call fcn.004359e4
mov dword [ebp - 0x824], 0
jmp 0x483ecd
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 2
jge 0x483eef
push dword [ebp - 0x824]
lea ecx, [ebp - 0x31f4]
call fcn.00435ad2
mov dword [eax], 0xbabe4a9f
jmp 0x483ec0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2dcc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x32d4], eax
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 4]
add eax, dword [ebp - 4]
cmp eax, 1
jge 0x483f1c
mov dword [ebp - 0x15cc], 1
jmp 0x483f23
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x15cc], eax
jl 0x483f3a
mov dword [ebp - 0x15d4], 1
jmp 0x483f41
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x15d4]
cmp eax, dword [ebp - 4]
jle 0x483f5b
mov dword [ebp - 0x15dc], 1
jmp 0x483f62
and dword [ebp - 0x15dc], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x15dc], eax
je 0x483f79
mov dword [ebp - 0x15e4], 1
jmp 0x483f80
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], 0xb89b
jle 0x484024
push 1
lea ecx, [ebp - 0x31e4]
call fcn.004359e4
mov dword [ebp - 0x82c], 0
jmp 0x483fb6
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 1
jge 0x483fd8
push dword [ebp - 0x82c]
lea ecx, [ebp - 0x31e4]
call fcn.00435ad2
mov dword [eax], 0xf27a4129
jmp 0x483fa9
mov dword [ebp - 4], 0
jmp 0x483fe8
cmp dword [ebp - 4], 0
jg 0x484014
mov byte [ebp - 0x247], 0
movzx eax, byte [ebp - 0x247]
test eax, eax
je 0x484012
push 0x2599
push 0xd5c
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x483fe1
lea ecx, [ebp - 0x31e4]
call fcn.00435ab6
jmp 0x484219
mov dword [ebp - 0x1604], 9
mov dword [ebp - 0x20c0], 0xffffffff
mov dword [ebp - 0x834], 0
jmp 0x484051
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 1
jge 0x48406d
mov eax, dword [ebp - 0x834]
mov dword [ebp + eax*4 - 0x368], 0x3423637b
jmp 0x484044
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2dd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x368], 0xffff
jne 0x484095
mov dword [ebp - 0x15ec], 1
jmp 0x48409c
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x448]
add eax, dword [ebp - 0x15ec]
jns 0x4840b6
mov dword [ebp - 0x15f4], 1
jmp 0x4840bd
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x448]
cmp dword [ebp - 0x15f4], eax
je 0x4840d7
mov dword [ebp - 0x15fc], 1
jmp 0x4840de
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x15fc]
mov dword [ebp - 0x1604], eax
mov eax, dword [ebp - 0x1604]
mov dword [ebp - 0x448], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x368]
cmp dword [ebp - 0x448], eax
jg 0x484117
mov dword [ebp - 4], 0x13
jmp 0x484229
push 1
lea ecx, [ebp - 0x960]
call fcn.004359e4
mov dword [ebp - 0x874], 0x342f3d47
mov dword [ebp - 0xaac], 0xceef
mov dword [ebp - 0x884], 6
mov dword [ebp - 0x1714], 0
mov dword [ebp - 0x174], 0
jmp 0x48472d
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x484749
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x1eac], 1
jmp 0x484720
mov dword [ebp - 0x174], 0
jmp 0x484762
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x484784
push dword [ebp - 0x174]
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov dword [eax], 0x3f4f46db
jmp 0x484755
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov dword [eax], 2
jmp 0x4847bd
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov dword [ebp - 0x16ac], eax
mov eax, dword [ebp - 0x16ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x16ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
cmp dword [eax], 0
jl 0x484ada
mov dword [ebp - 0x87c], 0xfffffff6
mov dword [ebp - 0x20c8], 5
mov dword [ebp - 0xaa4], 0x8325
cmp dword [ebp - 0x884], 0
jge 0x484806
mov dword [ebp - 0x16b4], 1
jmp 0x48480d
and dword [ebp - 0x16b4], 0
mov eax, dword [ebp - 0x16b4]
sub eax, dword [ebp - 0x884]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x20c8], eax
mov dword [ebp - 0x874], 2
jmp 0x484844
mov eax, dword [ebp - 0x874]
dec eax
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
jl 0x484ad5
mov dword [ebp - 0x20e0], 3
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x32ec], eax
cmp dword [ebp - 0xaac], 0x438e2136
jne 0x48487f
mov dword [ebp - 0x16bc], 1
jmp 0x484886
and dword [ebp - 0x16bc], 0
mov eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x16bc], eax
jl 0x4848a0
mov dword [ebp - 0x20d0], 1
jmp 0x4848a7
and dword [ebp - 0x20d0], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x87c], eax
jg 0x4848d7
mov eax, 0xa8ac
test eax, eax
je 0x4848d7
mov dword [ebp - 0x16c4], 1
jmp 0x4848de
and dword [ebp - 0x16c4], 0
cmp dword [ebp - 0x16c4], 0xffffffff
jne 0x4848f3
mov dword [ebp - 0x16cc], 1
jmp 0x4848fa
and dword [ebp - 0x16cc], 0
mov eax, dword [ebp - 0xaa4]
cmp eax, dword [ebp - 0x16cc]
jg 0x48492d
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1eac], 0
je 0x48492d
mov dword [ebp - 0x20d8], 1
jmp 0x484934
and dword [ebp - 0x20d8], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1eac]
mov dword [ebp - 0x2e34], eax
mov eax, 0xffff
cmp eax, 1
je 0x484966
mov dword [ebp - 0x16d4], 1
jmp 0x48496d
and dword [ebp - 0x16d4], 0
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1eac]
cmp eax, dword [ebp - 0x16d4]
jg 0x484997
mov dword [ebp - 0x16dc], 1
jmp 0x48499e
and dword [ebp - 0x16dc], 0
mov eax, dword [ebp - 0x16dc]
mov dword [ebp - 0x87c], eax
mov esi, dword [ebp - 0xaac]
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
mov edi, dword [ebp + eax*4 - 0x1eac]
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
add edi, dword [ebp + eax*4 - 0x1eac]
cmp esi, edi
jg 0x4849f5
cmp dword [ebp - 0xaac], 0xb2e0
jge 0x4849f5
and dword [ebp - 0x16e4], 0
jmp 0x4849ff
mov dword [ebp - 0x16e4], 1
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1eac]
cmp dword [ebp - 0x16e4], eax
jg 0x484a29
mov dword [ebp - 0x16ec], 1
jmp 0x484a30
and dword [ebp - 0x16ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1eac]
cmp dword [ebp - 0x16ec], eax
jle 0x484a51
mov dword [ebp - 0x16f4], 1
jmp 0x484a58
and dword [ebp - 0x16f4], 0
xor esi, esi
inc esi
sub esi, dword [ebp - 0x16f4]
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x1eac]
jne 0x484a85
mov dword [ebp - 0x16fc], 1
jmp 0x484a8c
and dword [ebp - 0x16fc], 0
cmp dword [ebp - 0x16fc], 0
jle 0x484aa1
mov dword [ebp - 0x1704], 1
jmp 0x484aa8
and dword [ebp - 0x1704], 0
cmp dword [ebp - 0x1704], 0xfffffff7
jne 0x484abd
mov dword [ebp - 0x170c], 1
jmp 0x484ac4
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x170c]
mov dword [ebp - 0x20e0], eax
jmp 0x484837
jmp 0x484799
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x1714], eax
mov esi, dword [ebp - 0x1714]
push 0
lea ecx, [ebp - 0x960]
call fcn.00435ad2
mov dword [eax], esi
lea ecx, [ebp - 0x960]
call fcn.00435ab6
mov dword [ebp - 0x88c], 0xffffffff
mov dword [ebp - 0x17c], 0
jmp 0x484b29
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x484b45
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x3598], 1
jmp 0x484b1c
mov dword [ebp - 0x17c], 0
jmp 0x484b5e
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 4
jge 0x484b7a
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x3640], 0xfffffffc
jmp 0x484b51
mov dword [ebp - 0x88c], 0xa
jmp 0x484b93
mov eax, dword [ebp - 0x88c]
dec eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 0xffffffec
jle 0x484c59
mov dword [ebp - 0x3108], 0x5e17
mov dword [ebp - 0x2e3c], 0xffffffff
push 1
lea ecx, [ebp - 0x3214]
call fcn.004359e4
mov dword [ebp - 0x184], 0
jmp 0x484bda
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x484bf9
push dword [ebp - 0x184]
lea ecx, [ebp - 0x3214]
call fcn.00435ad2
and dword [eax], 0
jmp 0x484bcd
mov dword [ebp - 0x184], 0
jmp 0x484c12
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x484c2e
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x171c], 0xe7b1
jmp 0x484c05
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x171c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x171c], eax
lea ecx, [ebp - 0x3214]
call fcn.00435ab6
jmp 0x484b86
mov byte [ebp - 0x24d], 0
movzx eax, byte [ebp - 0x24d]
test eax, eax
je 0x484c7d
push 0
push 0x2627
push 0x151f
call dword [sym.imp.GDI32.dll_CreatePen]
push 1
lea ecx, [ebp - 0x2b1c]
call fcn.004359e4
mov dword [ebp - 0x2100], 0x86e871d9
mov dword [ebp - 0x3388], 0
mov dword [ebp - 0x2e44], 0
mov dword [ebp - 0x3118], 0x8067e307
mov dword [ebp - 0x2110], 0x9ec4279c
mov dword [ebp - 0x2e4c], 0x7b80be39
mov dword [ebp - 0x32f4], 0x751cfd1f
mov dword [ebp - 0x2e54], 0xfffffff9
mov dword [ebp - 0x3128], 6
mov dword [ebp - 0x20f0], 0xe6e2bfbd
mov dword [ebp - 0x2e5c], 0x9008cf5a
mov dword [ebp - 0x1734], 1
mov dword [ebp - 0x33c8], 1
mov dword [ebp - 0x2e64], 1
mov dword [ebp - 0x2118], 1
mov dword [ebp - 0x3138], 9
mov dword [ebp - 0x2e6c], 0xfffffff8
mov dword [ebp - 0x32fc], 0x1de6fc60
mov dword [ebp - 0xab4], 0
mov dword [ebp - 0x20f8], 0
mov dword [ebp - 0x18c], 0
jmp 0x484d6b
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x484d8d
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x2b1c]
call fcn.00435ad2
mov dword [eax], 5
jmp 0x484d5e
mov dword [ebp - 0x18c], 0
jmp 0x484da6
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x484dc2
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x2984], 0xfffffffa
jmp 0x484d99
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x20e8], eax
mov eax, dword [ebp - 0xab4]
dec eax
mov dword [ebp - 0xab4], eax
cmp dword [ebp - 0x20e8], 0
jne 0x484e89
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2984]
mov dword [ebp - 0x2e74], eax
mov eax, dword [ebp - 0x20f0]
sub eax, dword [ebp - 0x20f8]
cmp dword [ebp - 0x2100], eax
jg 0x484e1a
mov dword [ebp - 0x2108], 1
jmp 0x484e21
and dword [ebp - 0x2108], 0
mov eax, dword [ebp - 0x2110]
mov dword [ebp - 0x3148], eax
push 0
lea ecx, [ebp - 0x2b1c]
call fcn.00435ad2
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2118]
cmp dword [ebp + eax - 0x2984], ecx
jg 0x484e5a
mov dword [ebp - 0x1724], 1
jmp 0x484e61
and dword [ebp - 0x1724], 0
cmp dword [ebp - 0x1724], 7
jb 0x484e76
mov dword [ebp - 0x172c], 1
jmp 0x484e7d
and dword [ebp - 0x172c], 0
cmp dword [ebp - 0x172c], 0x1181
jge 0x484eb4
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2984], 0
je 0x484eb4
mov byte [ebp - 0x24f], 0
movzx eax, byte [ebp - 0x24f]
test eax, eax
je 0x484eb2
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x484f0a
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x484ee6
push 0
push 0x2698
push 0x14d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov byte [ebp - 0x253], 0
movzx eax, byte [ebp - 0x253]
test eax, eax
je 0x484f0a
push 0x76b
push 0x1563
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [ebp - 0x1734]
mov dword [ebp - 0x1734], eax
lea ecx, [ebp - 0x2b1c]
call fcn.00435ab6
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x4c], 0xbd085c9e
mov dword [ebp - 0x894], 0
jmp 0x484f4b
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 1
jge 0x484f67
mov eax, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0xe8], 1
jmp 0x484f3e
mov dword [ebp - 0x90], 0
jmp 0x484f80
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jg 0x484fa8
mov byte [ebp - 0x255], 0
movzx eax, byte [ebp - 0x255]
test eax, eax
je 0x484fa6
push 0x1795
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x484f73
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe8], 0
jne 0x4850da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe8], 0
jne 0x484fd9
xor eax, eax
jne 0x484fd9
and dword [ebp - 0x173c], 0
jmp 0x484fe3
mov dword [ebp - 0x173c], 1
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x173c]
test eax, eax
je 0x485009
cmp dword [ebp - 0x90], 0
je 0x485009
and dword [ebp - 0x1744], 0
mov eax, dword [ebp - 0x1744]
sub eax, dword [ebp - 0x90]
cmp eax, 0x2240
jl 0x48502f
mov dword [ebp - 0x176c], 1
mov eax, dword [ebp - 0x4c]
add eax, 0xe58b
cmp eax, dword [ebp - 0x176c]
jle 0x485100
mov dword [ebp - 0x1774], 1
jmp 0x485107
and dword [ebp - 0x1774], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1774]
sub ecx, dword [ebp + eax - 0xe8]
je 0x485261
mov dword [ebp - 0x178c], 0x2ad015b0
mov dword [ebp - 0x177c], 0xed25e425
mov byte [ebp - 0x257], 0
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x485150
mov dword [ebp - 0xac4], 0xfffd
mov dword [ebp - 0x4c], 0
jmp 0x48527b