Function at 0x4730ee
Capabilities:
Create directory
Create process on windows
Enumerate files on windows
Get common file path
Get disk information
Get disk size
Get thread local storage value
Identify system language via api
Modify service
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3890
call fcn.004aa1a0
push esi
push edi
mov dword [ebp - 0x148], 0x57d6
push 3
lea ecx, [ebp - 0xbd8]
call fcn.00437959
mov dword [ebp - 0x610], 0x1d5f49dc
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x620], 0x1f13d464
mov dword [ebp - 0x1fa8], 0x84bafc8d
mov dword [ebp - 0x23c8], 0
mov dword [ebp - 0x1bc], 0
jmp 0x47315f
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x473181
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
mov dword [eax], 0xfffffffb
jmp 0x473152
mov dword [ebp - 0x1bc], 0
jmp 0x47319a
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x4731b6
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xc88], 8
jmp 0x47318d
cmp dword [ebp - 0x148], 0
je 0x473267
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x148], eax
je 0x4731dd
mov dword [ebp - 0x1f40], 1
jmp 0x4731e4
and dword [ebp - 0x1f40], 0
cmp dword [ebp - 0x148], 0
jne 0x4731f4
cmp dword [ebp - 0x148], 0
push 1
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
cmp dword [eax], 0xe7790660
je 0x473215
mov dword [ebp - 0x1c84], 1
jmp 0x47321c
and dword [ebp - 0x1c84], 0
push 2
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
mov ecx, dword [ebp - 0x1c84]
cmp ecx, dword [eax]
jg 0x47323f
mov dword [ebp - 0x1f48], 1
jmp 0x473246
and dword [ebp - 0x1f48], 0
mov eax, dword [ebp - 0x1f40]
imul eax, dword [ebp - 0x1f48]
cmp eax, dword [ebp - 0x148]
je 0x473267
mov dword [ebp - 0x21fc], 1
jmp 0x47326e
and dword [ebp - 0x21fc], 0
push 1
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
mov esi, dword [ebp - 0x148]
push 0
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
mov eax, dword [eax]
lea eax, [esi + eax + 3]
test eax, eax
jne 0x4732a4
mov dword [ebp - 0x1f50], 1
jmp 0x4732ab
and dword [ebp - 0x1f50], 0
cmp dword [ebp - 0x1f50], 0xffffffff
ja 0x4732d8
push 2
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
cmp dword [eax], 0
jne 0x4732d8
mov eax, 0x5a7d
test eax, eax
jne 0x4732d8
and dword [ebp - 0x1f58], 0
jmp 0x4732e2
mov dword [ebp - 0x1f58], 1
cmp dword [ebp - 0x1f58], 0xfffffffc
jl 0x4732f7
mov dword [ebp - 0x1f60], 1
jmp 0x4732fe
and dword [ebp - 0x1f60], 0
cmp dword [ebp - 0x1f60], 0x896e60be
je 0x473316
mov dword [ebp - 0x1f68], 1
jmp 0x47331d
and dword [ebp - 0x1f68], 0
mov eax, dword [ebp - 0x1f68]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x3424], eax
push 1
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
push 1
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
xor eax, eax
cmp eax, 1
ja 0x473362
mov dword [ebp - 0x1f70], 1
jmp 0x473369
and dword [ebp - 0x1f70], 0
cmp dword [ebp - 0x1f70], 1
jne 0x47337e
mov dword [ebp - 0x23a8], 1
jmp 0x473385
and dword [ebp - 0x23a8], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x33f0], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x1f78], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f78]
mov dword [ebp + eax - 0xc88], ecx
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x1f78], eax
jge 0x4733ca
mov dword [ebp - 0x1f80], 1
jmp 0x4733d1
and dword [ebp - 0x1f80], 0
mov esi, dword [ebp - 0x1f80]
sub esi, 0x6f9cbb95
push 1
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
cmp esi, dword [eax]
je 0x4733fa
mov dword [ebp - 0x1f88], 1
jmp 0x473401
and dword [ebp - 0x1f88], 0
mov eax, dword [ebp - 0x1f88]
sub eax, dword [ebp - 0x318]
je 0x473548
mov dword [ebp - 0x1fa0], 0xac57
mov eax, 0xbbfe
test eax, eax
je 0x473516
mov dword [ebp - 0x60c], 0
jmp 0x473443
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 2
jge 0x47345f
mov eax, dword [ebp - 0x60c]
mov dword [ebp + eax*4 - 0x2154], 0xe531
jmp 0x473436
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2154]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2154], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc88]
mov dword [ebp - 0x3140], eax
or eax, 0xffffffff
je 0x4734b0
push 1
lea ecx, [ebp - 0xbd8]
call fcn.00437a47
cmp dword [eax], 0
je 0x4734b0
mov dword [ebp - 0x1f98], 1
jmp 0x4734b7
and dword [ebp - 0x1f98], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2154]
mov dword [ebp - 0x1f90], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f90]
mov dword [ebp + eax - 0xc88], ecx
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x620], 0x3212
sub ecx, dword [ebp - 0x1f90]
add ecx, dword [ebp - 0x1f98]
imul ecx, dword [ebp + eax - 0x2154]
mov dword [ebp - 0x610], ecx
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
jmp 0x473543
mov dword [ebp - 0x23b0], 0xb42d225d
mov dword [ebp - 0x23b8], 0xb4f7bc72
mov eax, dword [ebp - 0x1fa0]
inc eax
mov dword [ebp - 0x1fa0], eax
mov eax, dword [ebp - 0x23b0]
mov dword [ebp - 0x23b8], eax
jmp 0x473752
mov dword [ebp - 0xa20], 0x9fa6
mov dword [ebp - 0x618], 0x1ab372c2
cmp dword [ebp - 0x610], 0
je 0x47357f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc88]
mov dword [ebp - 0x1fa8], eax
cmp dword [ebp - 0x1fa8], 0
mov eax, dword [ebp - 0xa20]
mov dword [ebp - 0x618], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc88]
cmp dword [ebp - 0x618], eax
jg 0x4735ac
mov dword [ebp - 0x1fb0], 1
jmp 0x4735b3
and dword [ebp - 0x1fb0], 0
mov eax, dword [ebp - 0xa20]
cmp eax, dword [ebp - 0x1fb0]
jl 0x4735cd
mov dword [ebp - 0x1fdc], 1
jmp 0x4735d4
and dword [ebp - 0x1fdc], 0
mov eax, dword [ebp - 0xa20]
imul eax, dword [ebp - 0x1fdc]
cmp eax, dword [ebp - 0x148]
jne 0x47373f
mov dword [ebp - 0x1fec], 1
mov dword [ebp - 0x23d0], 0x307f0789
mov dword [ebp - 0x318], 0x17
jmp 0x47361a
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xfffffff9
jne 0x47373d
mov dword [ebp - 0x7d8], 0
jmp 0x473640
mov eax, dword [ebp - 0x7d8]
inc eax
mov dword [ebp - 0x7d8], eax
cmp dword [ebp - 0x7d8], 1
jge 0x47365c
mov eax, dword [ebp - 0x7d8]
mov dword [ebp + eax*4 - 0x98c], 0x6c839c72
jmp 0x473633
mov dword [ebp - 0x618], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
cmp dword [ebp - 0x618], eax
jle 0x47368b
push 7
pop eax
test eax, eax
jne 0x47368b
and dword [ebp - 0x1fe4], 0
jmp 0x473695
mov dword [ebp - 0x1fe4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
cmp dword [ebp - 0x1fe4], eax
je 0x4736b6
mov dword [ebp - 0x23c0], 1
jmp 0x4736bd
and dword [ebp - 0x23c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
mov dword [ebp - 0x33d8], eax
mov eax, dword [ebp - 0x23c8]
mov dword [ebp - 0x3148], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98c]
mov dword [ebp - 0x33f8], eax
cmp dword [ebp - 0x1fec], 3
jae 0x473704
mov dword [ebp - 0x1ff4], 1
jmp 0x47370b
and dword [ebp - 0x1ff4], 0
mov eax, dword [ebp - 0x1fec]
cmp dword [ebp - 0x1ff4], eax
jl 0x473725
mov dword [ebp - 0x1ffc], 1
jmp 0x47372c
and dword [ebp - 0x1ffc], 0
mov eax, dword [ebp - 0x1ffc]
mov dword [ebp - 0x23d0], eax
jmp 0x47360d
jmp 0x473752
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x620]
mov dword [ebp + eax - 0xc88], ecx
lea ecx, [ebp - 0xbd8]
call fcn.00437a2b
push 1
lea ecx, [ebp - 0xc44]
call fcn.00437959
mov dword [ebp - 0xb0], 0x184c506d
mov dword [ebp - 0x202c], 0x91e6
mov dword [ebp - 0x23e8], 0xe6286c8a
mov dword [ebp - 0x7ec], 0
jmp 0x4737a1
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 1
jge 0x4737c3
push dword [ebp - 0x7ec]
lea ecx, [ebp - 0xc44]
call fcn.00437a47
mov dword [eax], 0xfd54
jmp 0x473794
mov byte [ebp - 0x2da], 0
movzx eax, byte [ebp - 0x2da]
test eax, eax
je 0x4737dd
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov dword [ebp - 0xb0], 0
jmp 0x4737f6
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x4739a9
mov dword [ebp - 0xbcc], 0x1b16
push 0
lea ecx, [ebp - 0xc44]
call fcn.00437a47
mov esi, eax
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.00437a47
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x47390f
push 0
lea ecx, [ebp - 0xc44]
call fcn.00437a47
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
neg ecx
je 0x473862
cmp dword [ebp - 0x202c], 0
je 0x473862
mov dword [ebp - 0x2004], 1
jmp 0x473869
and dword [ebp - 0x2004], 0
cmp dword [ebp - 0x2004], 0x9066
jl 0x473881
mov dword [ebp - 0x200c], 1
jmp 0x473888
and dword [ebp - 0x200c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x200c], eax
jge 0x4738a2
mov dword [ebp - 0x23d8], 1
jmp 0x4738a9
and dword [ebp - 0x23d8], 0
mov esi, dword [ebp - 0xb0]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.00437a47
cmp esi, dword [eax]
je 0x4738d9
cmp dword [ebp - 0xbcc], 0
je 0x4738d9
mov dword [ebp - 0x2014], 1
jmp 0x4738e0
and dword [ebp - 0x2014], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.00437a47
mov ecx, dword [ebp - 0x2014]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0xb0]
jge 0x47390b
cmp dword [ebp - 0xbcc], 0
jne 0x473921
xor eax, eax
jne 0x473921
cmp dword [ebp - 0xbcc], 0
jne 0x473921
and dword [ebp - 0x201c], 0
jmp 0x47392b
mov dword [ebp - 0x201c], 1
push 0
lea ecx, [ebp - 0xc44]
call fcn.00437a47
mov ecx, dword [ebp - 0x201c]
cmp ecx, dword [eax]
jl 0x47394e
mov dword [ebp - 0x2024], 1
jmp 0x473955
and dword [ebp - 0x2024], 0
cmp dword [ebp - 0x2024], 0xae65c342
ja 0x47396d
mov dword [ebp - 0x23e0], 1
jmp 0x473974
and dword [ebp - 0x23e0], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.00437a47
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc44]
call fcn.00437a47
mov eax, dword [eax]
sub eax, dword [ebp - 0x202c]
mov dword [ebp - 0x23e8], eax
jmp 0x4737e9
lea ecx, [ebp - 0xc44]
call fcn.00437a2b
mov dword [ebp - 0x138], 0x57d6
mov dword [ebp - 0x14], 0xfffffffe
push 3
lea ecx, [ebp - 0x9d8]
call fcn.00437959
mov dword [ebp - 0x8cc], 1
mov dword [ebp - 0xdc], 0x41b6ba00
mov dword [ebp - 0x2408], 0x5481f04f
mov dword [ebp - 0x628], 0
jmp 0x473a09
mov eax, dword [ebp - 0x628]
inc eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 3
jge 0x473a2b
push dword [ebp - 0x628]
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov dword [eax], 0x44198d72
jmp 0x4739fc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2034], eax
push 1
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov ecx, dword [ebp - 0x2034]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2034]
jne 0x473a60
mov dword [ebp - 0x203c], 1
jmp 0x473a67
and dword [ebp - 0x203c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x203c]
add eax, 0xbe92
cmp dword [ebp - 0x14], eax
jge 0x473a8a
cmp dword [ebp - 0x14], 0
jne 0x473a8a
and dword [ebp - 0x2044], 0
jmp 0x473a94
mov dword [ebp - 0x2044], 1
mov eax, dword [ebp - 0x2044]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x8cc], eax
je 0x473ab7
mov dword [ebp - 0x204c], 1
jmp 0x473abe
and dword [ebp - 0x204c], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x204c]
cmp eax, dword [ebp - 0x14]
jge 0x473ad8
mov dword [ebp - 0x2054], 1
jmp 0x473adf
and dword [ebp - 0x2054], 0
cmp dword [ebp - 0x2054], 0x3809
jg 0x473af7
mov dword [ebp - 0x205c], 1
jmp 0x473afe
and dword [ebp - 0x205c], 0
mov eax, dword [ebp - 0x205c]
sub eax, 0x3927
cmp eax, 0x6e31
jl 0x473b1c
mov dword [ebp - 0x2064], 1
jmp 0x473b23
and dword [ebp - 0x2064], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2064]
jg 0x473b3a
mov dword [ebp - 0x206c], 1
jmp 0x473b41
and dword [ebp - 0x206c], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x206c]
cmp eax, 0x83de467b
jbe 0x473b5e
push 1
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x473b72
mov dword [ebp - 0x2074], 1
jmp 0x473b79
and dword [ebp - 0x2074], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2074], eax
jl 0x473b90
mov dword [ebp - 0x207c], 1
jmp 0x473b97
and dword [ebp - 0x207c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x207c], eax
jl 0x473bae
mov dword [ebp - 0x2084], 1
jmp 0x473bb5
and dword [ebp - 0x2084], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2084], eax
jge 0x473bcc
mov dword [ebp - 0x208c], 1
jmp 0x473bd3
and dword [ebp - 0x208c], 0
mov eax, dword [ebp - 0x208c]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xdc], 2
jmp 0x473bf8
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x473e43
mov dword [ebp - 0x2094], 0xfffffff8
mov dword [ebp - 0xd18], 0x6a332e52
mov dword [ebp - 0x2400], 1
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
cmp dword [eax], 0
je 0x473c5e
mov dword [ebp - 0x2094], 0x71c2
cmp dword [ebp - 0x2094], 0xfffffffb
jne 0x473c5e
cmp dword [ebp - 0x14], 0
je 0x473c5e
mov dword [ebp - 0x2104], 1
jmp 0x473c65
and dword [ebp - 0x2104], 0
push 1
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov esi, dword [ebp - 0x2104]
add esi, dword [eax]
add esi, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
cmp esi, dword [eax]
jl 0x473c9a
mov dword [ebp - 0x20f0], 1
jmp 0x473ca1
and dword [ebp - 0x20f0], 0
cmp dword [ebp - 0x20f0], 1
jb 0x473cb6
mov dword [ebp - 0x1ed4], 1
jmp 0x473cbd
and dword [ebp - 0x1ed4], 0
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1ed4]
jg 0x473ce4
mov dword [ebp - 0x1c10], 1
jmp 0x473ceb
and dword [ebp - 0x1c10], 0
push 1
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov ecx, dword [ebp - 0x1c10]
cmp ecx, dword [eax]
jle 0x473d0e
mov dword [ebp - 0x23f0], 1
jmp 0x473d15
and dword [ebp - 0x23f0], 0
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov dword [ebp - 0xd10], eax
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x9d8]
call fcn.00437a47
mov ecx, dword [ebp - 0xd10]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd10]
cmp dword [eax], 0
jne 0x473d72
cmp dword [ebp - 0x14], 0
jne 0x473d72
and dword [ebp - 0x1c18], 0
jmp 0x473d7c
mov dword [ebp - 0x1c18], 1
mov eax, dword [ebp - 0xd18]
cmp dword [ebp - 0x1c18], eax
jge 0x473d96
mov dword [ebp - 0x23f8], 1
jmp 0x473d9d
and dword [ebp - 0x23f8], 0
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0x3150], eax
cmp dword [ebp - 0x14], 0xee34d1cd
je 0x473dbe
mov dword [ebp - 0x1c20], 1
jmp 0x473dc5
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0x2400]
cmp dword [ebp - 0x1c20], eax
jg 0x473ddf
mov dword [ebp - 0xd20], 1
jmp 0x473de6
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 0xfff7
je 0x473e0a
mov dword [ebp - 0x1c28], 1
jmp 0x473e11
and dword [ebp - 0x1c28], 0
mov eax, dword [ebp - 0x1c28]
mov dword [ebp - 0x2408], eax
mov byte [ebp - 0x379], 0
movzx eax, byte [ebp - 0x379]
test eax, eax
je 0x473e3e
push 0
push 0x1fe9
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x473beb
lea ecx, [ebp - 0x9d8]
call fcn.00437a2b
push 3
lea ecx, [ebp - 0xc08]
call fcn.00437959
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x638], 0x1ba80278
mov dword [ebp - 0x1c58], 0xdfa536ca
mov dword [ebp - 0x630], 0
jmp 0x473e92
mov eax, dword [ebp - 0x630]
inc eax
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 3
jge 0x473eae
mov eax, dword [ebp - 0x630]
mov dword [ebp + eax*4 - 0xbe8], 0
jmp 0x473e85
mov dword [ebp - 0x320], 0xffffffff
jmp 0x473ec7
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0xfffffffd
je 0x4742f6
mov dword [ebp - 0xc], 7
mov dword [ebp - 0x4c0], 0xfffffff7
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0xc], 2
jmp 0x473eff
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x474234
mov dword [ebp - 0xd40], 0x16e31137
mov byte [ebp - 0x3eb], 0
movzx eax, byte [ebp - 0x3eb]
test eax, eax
je 0x473f34
push 0
push 0
push 0x930
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xbe8]
mov dword [ebp - 0x3400], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xbe8], 0
jne 0x473f5d
mov dword [ebp - 0x2410], 1
jmp 0x473f64
and dword [ebp - 0x2410], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xbe8], 0
jne 0x473fa0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add eax, dword [ebp + ecx*4 - 0xbe8]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0xbe8]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp + ecx*4 - 0xbe8]
jl 0x473fa0
and dword [ebp - 0x2418], 0
jmp 0x473faa
mov dword [ebp - 0x2418], 1
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp + eax*4 - 0xbe8], 0xfff9
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x3158], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x33e4], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xbe8], 0xe018ebdb
jbe 0x473ff2
mov dword [ebp - 0xd28], 1
jmp 0x473ff9
and dword [ebp - 0xd28], 0
mov eax, dword [ebp - 0xd28]
add eax, 0x22b60780
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0xe9e5
jg 0x474022
mov dword [ebp - 0x1c30], 1
jmp 0x474029
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0x1c30]
sub eax, 0xdfc1
cmp eax, dword [ebp - 0xc]
jg 0x474045
mov dword [ebp - 0xd30], 1
jmp 0x47404c
and dword [ebp - 0xd30], 0
cmp dword [ebp - 0xd30], 0
jne 0x474091
mov byte [ebp - 0x381], 0
movzx eax, byte [ebp - 0x381]
test eax, eax
je 0x47408c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x130b
push 0x1e56
push 0x1de3
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x47422f
mov dword [ebp - 0xa28], 4
mov dword [ebp - 0x7f4], 0
jmp 0x4740b4
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 2
jge 0x4740d0
mov eax, dword [ebp - 0x7f4]
mov dword [ebp + eax*4 - 0x246c], 2
jmp 0x4740a7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x246c], 0
je 0x474106
mov dword [ebp - 0x3160], 0xd41b
mov dword [ebp - 0x1c38], 0xfffffff6
mov eax, dword [ebp - 0x1c38]
inc eax
mov dword [ebp - 0x1c38], eax
jmp 0x474190
mov dword [ebp - 0x2420], 0xffff
mov dword [ebp - 0xd38], 0x9cc0f90
mov eax, dword [ebp - 0x2420]
mov ecx, dword [ebp - 0xc]
imul eax, dword [ebp + ecx*4 - 0xbe8]
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0xa442f2aa
jae 0x474149
mov dword [ebp - 0x2428], 1
jmp 0x474150
and dword [ebp - 0x2428], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x34e0], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0xbe8]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x4c0]
jg 0x47417d
mov dword [ebp - 0x1c40], 1
jmp 0x474184
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x1c40]
mov dword [ebp - 0x4c0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x246c], 0
je 0x4741b5
cmp dword [ebp - 0xa28], 1
jbe 0x4741b5
mov dword [ebp - 0x2430], 1
jmp 0x4741bc
and dword [ebp - 0x2430], 0
mov eax, dword [ebp - 0xa28]
mov dword [ebp - 0x3168], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x246c]
mov dword [ebp - 0x33ec], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0x3170], eax
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0x3540], eax
mov eax, dword [ebp - 0xd40]
cmp dword [ebp - 0xc], eax
je 0x474219
cmp dword [ebp - 0xa28], 0
jne 0x474219
and dword [ebp - 0x1c48], 0
jmp 0x474223
mov dword [ebp - 0x1c48], 1
mov eax, dword [ebp - 0x1c48]
mov dword [ebp - 0x4c0], eax
jmp 0x473ef8
cmp dword [ebp - 0x1c58], 0
jne 0x474277
push 4
pop eax
shl eax, 1
xor ecx, ecx
sub ecx, dword [ebp + eax - 0xbe8]
cmp dword [ebp - 0xc], ecx
jge 0x47425c
mov dword [ebp - 0xd48], 1
jmp 0x474263
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xd48], eax
jne 0x474277
and dword [ebp - 0x1c50], 0
jmp 0x474281
mov dword [ebp - 0x1c50], 1
mov eax, dword [ebp - 0x638]
cmp eax, dword [ebp - 0x1c50]
je 0x4742a4
cmp dword [ebp - 0x320], 0
je 0x4742a4
mov dword [ebp - 0xd50], 1
jmp 0x4742ab
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0xd50]
neg eax
cmp eax, 9
je 0x4742c4
mov dword [ebp - 0xd58], 1
jmp 0x4742cb
and dword [ebp - 0xd58], 0
mov eax, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0x1c58]
imul ecx, dword [ebp - 0xd58]
lea eax, [eax + ecx + 0xb95d008]
imul eax, eax, 0x8fb8
mov dword [ebp - 0x638], eax
jmp 0x473eba
mov dword [ebp - 0x6b8], 0x1d5f49dc
mov dword [ebp - 0xe8], 0xfffffff9
mov dword [ebp - 0x4c4], 0x280643b8
mov dword [ebp - 0x128], 0xc9dffbe5
mov dword [ebp - 0x150], 0xcbfb41ce
mov dword [ebp - 0xdc8], 0x8211abd
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x3178], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x33f4], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x3180], eax
or eax, 0xffffffff
cmp eax, 0xfffffffc
jne 0x47436a
mov dword [ebp - 0x2438], 1
jmp 0x474371
and dword [ebp - 0x2438], 0
mov eax, dword [ebp - 0x4c4]
add eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x4c4]
jge 0x474391
mov dword [ebp - 0x1c60], 1
jmp 0x474398
and dword [ebp - 0x1c60], 0
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x1c60]
jne 0x4743b2
mov dword [ebp - 0xd60], 1
jmp 0x4743b9
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0xd60]
sub eax, dword [ebp - 0xe8]
imul eax, eax, 0
mov dword [ebp - 0x128], eax
mov dword [ebp - 0xe8], 0x17
jmp 0x4743e7
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 8
jne 0x474901
and dword [ebp - 0x2b28], 0
and dword [ebp - 0x2b24], 0
and dword [ebp - 0x2b20], 0
and dword [ebp - 0x2b1c], 0
lea ecx, [ebp - 0xa0d]
call fcn.00437a56
push eax
lea eax, [ebp - 0x2b18]
push eax
lea eax, [ebp - 0x2b28]
push eax
lea ecx, [ebp - 0x3768]
call fcn.00437a59
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x20a4]
call fcn.00437a05
mov dword [ebp - 0xda0], 0xb2f67ab
mov dword [ebp - 0x1c68], 0x7d69fdb8
mov dword [ebp - 0x248], 0
jmp 0x474472
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x47448e
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x34a4], 1
jmp 0x474465
mov dword [ebp - 0x248], 0
jmp 0x4744a7
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x4744c3
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x35ac], 1
jmp 0x47449a
mov dword [ebp - 0x128], 0
jmp 0x4744dc
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jg 0x4748f1
mov dword [ebp - 0xd80], 0x25cceb8a
mov dword [ebp - 0xdb0], 0x2f548f9f
push dword [ebp - 0x128]
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1c68], eax
cmp dword [ebp - 0x1c68], 0
je 0x47452f
mov dword [ebp - 0xd68], 1
jmp 0x474536
and dword [ebp - 0xd68], 0
cmp dword [ebp - 0x128], 0x717c264f
jle 0x47454e
mov dword [ebp - 0x1c70], 1
jmp 0x474555
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0xd68]
cmp eax, dword [ebp - 0x1c70]
jne 0x47456f
mov dword [ebp - 0xd70], 1
jmp 0x474576
and dword [ebp - 0xd70], 0
push dword [ebp - 0x128]
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
mov ecx, dword [ebp - 0xd70]
cmp ecx, dword [eax]
jle 0x47459d
mov dword [ebp - 0x1c78], 1
jmp 0x4745a4
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x1c78], eax
jle 0x4745be
mov dword [ebp - 0xd78], 1
jmp 0x4745c5
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x4c4]
cmp dword [ebp - 0xd78], eax
jne 0x4745df
mov dword [ebp - 0x1c80], 1
jmp 0x4745e6
and dword [ebp - 0x1c80], 0
mov eax, dword [ebp - 0x1c80]
mov dword [ebp - 0xd80], eax
cmp dword [ebp - 0xd80], 7
jge 0x47460d
cmp dword [ebp - 0x4c4], 0
jne 0x47460d
and dword [ebp - 0x1c88], 0
jmp 0x474617
mov dword [ebp - 0x1c88], 1
mov eax, dword [ebp - 0x4c4]
cmp dword [ebp - 0x1c88], eax
je 0x474631
mov dword [ebp - 0xd88], 1
jmp 0x474638
and dword [ebp - 0xd88], 0
cmp dword [ebp - 0xd88], 0xb9d6240c
jbe 0x474650
mov dword [ebp - 0x1c90], 1
jmp 0x474657
and dword [ebp - 0x1c90], 0
cmp dword [ebp - 0x1c90], 0xa3ebef27
jb 0x47466f
mov dword [ebp - 0xd90], 1
jmp 0x474676
and dword [ebp - 0xd90], 0
push 3
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
mov esi, dword [ebp - 0xd90]
imul esi, dword [eax]
push dword [ebp - 0x128]
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
sub esi, dword [eax]
cmp esi, 0xb8b2ef5e
ja 0x4746b3
mov dword [ebp - 0x1c98], 1
jmp 0x4746ba
and dword [ebp - 0x1c98], 0
imul eax, dword [ebp - 0x1c98], 0
cmp eax, 0x52f1
jne 0x4746d4
mov dword [ebp - 0xd98], 1
jmp 0x4746db
and dword [ebp - 0xd98], 0
imul esi, dword [ebp - 0xd98], 9
push 3
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
cmp esi, dword [eax]
jne 0x4746ff
mov dword [ebp - 0x1ca0], 1
jmp 0x474706
and dword [ebp - 0x1ca0], 0
cmp dword [ebp - 0x1ca0], 0x869b92b2
jbe 0x47471e
mov dword [ebp - 0x1ca8], 1
jmp 0x474725
and dword [ebp - 0x1ca8], 0
mov dword [ebp - 0xda0], 0xffffffff
mov esi, dword [ebp - 0xda0]
push 0
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
mov ecx, dword [ebp - 0x1ca8]
add ecx, dword [eax]
cmp esi, ecx
jge 0x47475a
mov dword [ebp - 0xda8], 1
jmp 0x474761
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0xdc8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x34a4]
dec eax
mov dword [ebp - 0x1cb0], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1cb0]
mov dword [ebp + eax - 0x35ac], ecx
mov eax, dword [ebp - 0x1cb0]
mov dword [ebp - 0xdb0], eax
cmp dword [ebp - 0xdb0], 0
je 0x4748cf
mov dword [ebp - 0xa30], 0xc59c
mov dword [ebp - 0x1cb8], 0xfffffffd
mov dword [ebp - 0x150], 0
jmp 0x4747da
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x4748cd
mov eax, dword [ebp - 0x1cb8]
mov dword [ebp - 0x34e8], eax
mov eax, 0x2f10
test eax, eax
jne 0x47480e
cmp dword [ebp - 0x1cb8], 0
jne 0x47480e
and dword [ebp - 0xdb8], 0
jmp 0x474818
mov dword [ebp - 0xdb8], 1
push dword [ebp - 0x128]
lea ecx, [ebp - 0x20a4]
call fcn.00437a47
mov eax, dword [eax]
sub eax, dword [ebp - 0xdb8]
mov ecx, dword [ebp - 0x150]
cmp eax, dword [ebp + ecx*4 - 0x34a4]
jg 0x47484c
mov dword [ebp - 0x1cc0], 1
jmp 0x474853
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0xa30]
inc eax
mov dword [ebp - 0xa30], eax
mov eax, dword [ebp - 0xa30]
mov ecx, dword [ebp - 0x150]
imul eax, dword [ebp + ecx*4 - 0x34a4]
sub eax, dword [ebp - 0x1cc0]
cmp eax, 0xd6f46937
jne 0x47488d
mov dword [ebp - 0xdc0], 1
jmp 0x474894
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp + eax*4 - 0x35ac]
cmp eax, dword [ebp - 0xdc0]
jle 0x4748b5
mov dword [ebp - 0x1cc8], 1
jmp 0x4748bc
and dword [ebp - 0x1cc8], 0
mov eax, dword [ebp - 0x1cc8]
mov dword [ebp - 0xdc8], eax
jmp 0x4747cd
jmp 0x4748ec
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x4748ec
push 0xe63
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4744cf
lea ecx, [ebp - 0x20a4]
call fcn.00437a2b
jmp 0x4743da
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x408], 0
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x54c], 0x90b1c5ad
mov dword [ebp - 0x1cf8], 7
mov dword [ebp - 0x2448], 1
mov dword [ebp - 0xe08], 0x33a9025b
mov dword [ebp - 0x93c], 0
jmp 0x47495d
mov eax, dword [ebp - 0x93c]
inc eax
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x93c], 4
jge 0x474979
mov eax, dword [ebp - 0x93c]
mov dword [ebp + eax*4 - 0x2890], 0x64d9248e
jmp 0x474950
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3188], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x68], eax
jge 0x47499f
mov dword [ebp - 0x1cd0], 1
jmp 0x4749a6
and dword [ebp - 0x1cd0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1cd0], eax
jg 0x4749c0
cmp dword [ebp - 0x68], 0
jne 0x4749c0
and dword [ebp - 0xdd0], 0
jmp 0x4749ca
mov dword [ebp - 0xdd0], 1
cmp dword [ebp - 0xdd0], 0xf37d437f
jbe 0x4749e2
mov dword [ebp - 0x1cd8], 1
jmp 0x4749e9
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1cd8], eax
je 0x474a10
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2890], 0
je 0x474a10
mov dword [ebp - 0xdd8], 1
jmp 0x474a17
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x408]
cmp eax, dword [ebp - 0xdd8]
je 0x474a31
mov dword [ebp - 0x1ce0], 1
jmp 0x474a38
and dword [ebp - 0x1ce0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2890]
cmp dword [ebp - 0x1ce0], eax
jg 0x474a59
mov dword [ebp - 0xde0], 1
jmp 0x474a60
and dword [ebp - 0xde0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2890]
cmp dword [ebp - 0xde0], eax
jg 0x474a81
mov dword [ebp - 0x1ce8], 1
jmp 0x474a88
and dword [ebp - 0x1ce8], 0
cmp dword [ebp - 0x1ce8], 0xfffffffd
jge 0x474a98
push 5
pop eax
test eax, eax
jne 0x474aa5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2890], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x33fc], eax
cmp dword [ebp - 0x408], 0xfffffff7
jl 0x474ac6
mov dword [ebp - 0x2440], 1
jmp 0x474acd
and dword [ebp - 0x2440], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x3190], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x3570], eax
cmp dword [ebp - 0x68], 0
je 0x474afd
mov eax, 0x3e5f
test eax, eax
je 0x474afd
and dword [ebp - 0xde8], 0
jmp 0x474b07
mov dword [ebp - 0xde8], 1
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0xde8], eax
jne 0x474b21
mov dword [ebp - 0x1cf0], 1
jmp 0x474b28
and dword [ebp - 0x1cf0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2890]
imul eax, dword [ebp - 0x1cf0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2890]
jne 0x474b57
mov dword [ebp - 0xdf0], 1
jmp 0x474b5e
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x1cf8], eax
mov eax, dword [ebp - 0x1cf8]
mov dword [ebp - 0x3198], eax
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0x68], eax
jne 0x474b8d
mov dword [ebp - 0xdf8], 1
jmp 0x474b94
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0xdf8], eax
jle 0x474bae
mov dword [ebp - 0x1d00], 1
jmp 0x474bb5
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0x1d00], eax
jg 0x474bd5
cmp dword [ebp - 0x54c], 0
jne 0x474bd5
and dword [ebp - 0xe00], 0
jmp 0x474bdf
mov dword [ebp - 0xe00], 1
mov eax, dword [ebp - 0x2448]
cmp dword [ebp - 0xe00], eax
jg 0x474bf9
mov dword [ebp - 0x1d08], 1
jmp 0x474c00
and dword [ebp - 0x1d08], 0
mov eax, dword [ebp - 0x1d08]
mov dword [ebp - 0xe08], eax
mov dword [ebp - 0x68], 0xffffffed
jmp 0x474c1c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x1b
jg 0x474c3f
mov dword [ebp - 0x2450], 1
mov eax, dword [ebp - 0xe08]
sub eax, 0xddd0
mov dword [ebp - 0x2450], eax
jmp 0x474c15
mov dword [ebp - 0x29b4], 0xa5d6c05b
mov dword [ebp - 0x29b0], 0xa5d6c05b
mov dword [ebp - 0x29ac], 0xa5d6c05b
mov dword [ebp - 0x29a8], 0xa5d6c05b
mov dword [ebp - 0x4cc], 0
push 2
lea ecx, [ebp - 0x2c28]
call fcn.00437959
mov dword [ebp - 0x49c], 0xec3203b
mov dword [ebp - 0x640], 0
jmp 0x474ca1
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 2
jge 0x474cc3
push dword [ebp - 0x640]
lea ecx, [ebp - 0x2c28]
call fcn.00437a47
mov dword [eax], 0xfffffffa
jmp 0x474c94
mov dword [ebp - 0x4cc], 0
jmp 0x474cdc
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 3
jg 0x474e26
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0x3404], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x474d16
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x474d32
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x37f8], 0x415d7249
jmp 0x474d09
mov dword [ebp - 0x1d0], 0
jmp 0x474d4b
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x474d67
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x1d10], 0xd49598aa
jmp 0x474d3e
mov dword [ebp - 0x7fc], 3
jmp 0x474d80
mov eax, dword [ebp - 0x7fc]
dec eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0
jl 0x474e21
mov dword [ebp - 0x31a0], 0x6e6f
mov dword [ebp - 0x34f0], 0x21f90ef3
mov dword [ebp - 0x31a8], 0xfffffffd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d10]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d10], eax
mov dword [ebp - 0x49c], 1
jmp 0x474ddf
mov eax, dword [ebp - 0x49c]
dec eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
jl 0x474e1c
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [ebp - 0x49c]
mov eax, dword [ebp + eax*4 - 0x29b4]
mov dword [ebp + ecx*4 - 0x29ac], eax
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x2c28]
call fcn.00437a47
cmp dword [eax], 0
je 0x474e1a
jmp 0x474dd2
jmp 0x474dd2
jmp 0x474d73
jmp 0x474ccf
mov byte [ebp - 0x389], 0
movzx eax, byte [ebp - 0x389]
test eax, eax
je 0x474e45
push 0xe5d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x2c28]
call fcn.00437a2b
mov dword [ebp - 0x954], 0x1f13d464
push 4
lea ecx, [ebp - 0xbf8]
call fcn.00437959
mov dword [ebp - 0x98], 9
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0x4d4], 1
mov dword [ebp - 0x648], 0
jmp 0x474e9e
mov eax, dword [ebp - 0x648]
inc eax
mov dword [ebp - 0x648], eax
cmp dword [ebp - 0x648], 4
jge 0x474ebd
push dword [ebp - 0x648]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
or dword [eax], 0xffffffff
jmp 0x474e91
mov dword [ebp - 0x98], 0
jmp 0x474ed6
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jg 0x475213
mov dword [ebp - 0xcc], 0x9a2b441a
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov ecx, dword [ebp - 0x4d4]
cmp dword [eax], ecx
jne 0x474f25
mov dword [ebp - 0xe10], 1
jmp 0x474f2c
and dword [ebp - 0xe10], 0
imul eax, dword [ebp - 0xe10], 0x2c57
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x5d0], eax
jle 0x474f56
mov dword [ebp - 0x1d18], 1
jmp 0x474f5d
and dword [ebp - 0x1d18], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov ecx, dword [ebp - 0x1d18]
neg ecx
cmp dword [eax], ecx
jle 0x474f86
mov dword [ebp - 0xe18], 1
jmp 0x474f8d
and dword [ebp - 0xe18], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe18]
jl 0x474fb4
mov dword [ebp - 0x1d20], 1
jmp 0x474fbb
and dword [ebp - 0x1d20], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov ecx, dword [ebp - 0x1d20]
cmp ecx, dword [eax]
jle 0x474fe2
mov dword [ebp - 0xe20], 1
jmp 0x474fe9
and dword [ebp - 0xe20], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe20]
jl 0x475055
mov dword [ebp - 0xcc], 0
jmp 0x47501d
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jg 0x475050
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov esi, eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x475010
jmp 0x47520e
mov dword [ebp - 0x5d0], 0xffffffe7
jmp 0x47506e
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 0xfffffff0
jg 0x47520e
or dword [ebp - 0x2a60], 0xffffffff
or dword [ebp - 0x2a5c], 0xffffffff
or dword [ebp - 0x2a58], 0xffffffff
or dword [ebp - 0x2a54], 0xffffffff
lea ecx, [ebp - 0xa15]
call fcn.00437a56
push eax
lea eax, [ebp - 0x2a50]
push eax
lea eax, [ebp - 0x2a60]
push eax
lea ecx, [ebp - 0x36a8]
call fcn.00437a59
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x32a4]
call fcn.00437a05
mov dword [ebp - 0x2568], 0x50169ff9
mov dword [ebp - 0xcc], 3
jmp 0x4750ef
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x4751e1
push 0
lea ecx, [ebp - 0x32a4]
call fcn.00437a47
cmp dword [eax], 1
jae 0x47511a
mov dword [ebp - 0x1d28], 1
jmp 0x475121
and dword [ebp - 0x1d28], 0
cmp dword [ebp - 0x1d28], 0xfffffff8
jge 0x475136
mov dword [ebp - 0xe28], 1
jmp 0x47513d
and dword [ebp - 0xe28], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0xbf8]
call fcn.00437a47
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe28]
jne 0x47517a
mov dword [ebp - 0x2458], 0x9ca3eaa3
mov dword [ebp - 0x2460], 0x877e0698
mov eax, dword [ebp - 0x2458]
mov dword [ebp - 0x2460], eax
jmp 0x4751dc
mov dword [ebp - 0x1d30], 0x2b00
mov dword [ebp - 0x4d4], 0
jmp 0x47519d
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 3
jg 0x4751d2
mov byte [ebp - 0x3ef], 0
movzx eax, byte [ebp - 0x3ef]
test eax, eax
je 0x4751c3
push 0x11ef
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x1d30]
inc eax
mov dword [ebp - 0x1d30], eax
jmp 0x475190
mov dword [ebp - 0x2568], 0x6a4abff1
jmp 0x4750e2
mov byte [ebp - 0x391], 0
movzx eax, byte [ebp - 0x391]
test eax, eax
je 0x4751fe
push 0x1b3e
call dword [sym.imp.USER32.dll_GetKeyboardType]
lea ecx, [ebp - 0x32a4]
call fcn.00437a2b
jmp 0x475061
jmp 0x474ec9
lea ecx, [ebp - 0xbf8]
call fcn.00437a2b
mov dword [ebp - 0x1cfc], 0x84bafc8d
or dword [ebp - 0x2ba0], 0xffffffff
or dword [ebp - 0x2b9c], 0xffffffff
or dword [ebp - 0x2b98], 0xffffffff
or dword [ebp - 0x2b94], 0xffffffff
lea ecx, [ebp - 0xb35]
call fcn.00437a56
push eax
lea eax, [ebp - 0x2b90]
push eax
lea eax, [ebp - 0x2ba0]
push eax
lea ecx, [ebp - 0x36b8]
call fcn.00437a59
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc80]
call fcn.00437a05
mov dword [ebp - 0xb8], 0x84c506d4
mov dword [ebp - 0xe90], 1
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x330], 1
mov dword [ebp - 0xb8], 0
jmp 0x4752ba
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jg 0x475a17
mov dword [ebp - 0x650], 5
mov dword [ebp - 0x1d78], 4
push 3
lea ecx, [ebp - 0x28e4]
call fcn.00437959
mov dword [ebp - 0x158], 0
jmp 0x475301
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x47531d
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0xb10], 0xffffffff
jmp 0x4752f4
mov dword [ebp - 0x158], 0
jmp 0x475336
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x475358
push dword [ebp - 0x158]
lea ecx, [ebp - 0x28e4]
call fcn.00437a47
mov dword [eax], 1
jmp 0x475329
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0x330], eax
jl 0x4753ff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb10], 9
push 9
pop eax
test eax, eax
je 0x4753ab
mov eax, 0xc1b1
test eax, eax
je 0x4753ab
mov dword [ebp - 0xe30], 1
jmp 0x4753b2
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0xe30], eax
jg 0x4753d0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb10], 0
jne 0x4753de
or eax, 0xffffffff
jne 0x4753de
and dword [ebp - 0x1d38], 0
jmp 0x4753e8
mov dword [ebp - 0x1d38], 1
mov eax, dword [ebp - 0x330]
add eax, dword [ebp - 0x1d38]
jne 0x4753ff
and dword [ebp - 0xe38], 0
jmp 0x475409
mov dword [ebp - 0xe38], 1
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xe38], eax
jg 0x475423
mov dword [ebp - 0x1d40], 1
jmp 0x47542a
and dword [ebp - 0x1d40], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1d40]
jg 0x475451
mov dword [ebp - 0xe40], 1
jmp 0x475458
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 1
jne 0x47546d
mov dword [ebp - 0x1d48], 1
jmp 0x475474
and dword [ebp - 0x1d48], 0
mov eax, dword [ebp - 0x1d48]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x650], eax
jge 0x47549a
mov dword [ebp - 0xe48], 1
jmp 0x4754a1
and dword [ebp - 0xe48], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov esi, eax
push 3
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov edi, dword [eax]
add edi, dword [ebp - 0xe48]
imul edi, dword [ebp - 0x328]
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xc80]
call fcn.00437a47
imul edi, dword [eax]
cmp dword [esi], edi
jle 0x4754fb
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x4754fb
mov dword [ebp - 0x2570], 1
jmp 0x475502
and dword [ebp - 0x2570], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov eax, dword [ebp - 0xe90]
cmp dword [ebp - 0x330], eax
jne 0x47552d
mov dword [ebp - 0x1d50], 1
jmp 0x475534
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0x328]
imul eax, dword [ebp - 0x1d50]
test eax, eax
je 0x4759f1
mov dword [ebp - 0x554], 0xffffffff
mov dword [ebp - 0xc38], 1
mov dword [ebp - 0xa38], 1
cmp dword [ebp - 0x1d78], 0
jne 0x475582
cmp dword [ebp - 0x554], 1
jg 0x475582
and dword [ebp - 0xe50], 0
jmp 0x47558c
mov dword [ebp - 0xe50], 1
cmp dword [ebp - 0xe50], 7
jne 0x4755a1
mov dword [ebp - 0x1d58], 1
jmp 0x4755a8
and dword [ebp - 0x1d58], 0
mov eax, dword [ebp - 0x1d58]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 5
jbe 0x4755d5
mov dword [ebp - 0x1d70], 1
jmp 0x4755dc
and dword [ebp - 0x1d70], 0
mov esi, dword [ebp - 0x554]
push 3
lea ecx, [ebp - 0xc80]
call fcn.00437a47
imul esi, dword [eax]
cmp esi, 0xffffffff
jle 0x475603
mov dword [ebp - 0xe58], 1
jmp 0x47560a
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0xc38], eax
cmp dword [ebp - 0xc38], 0
jne 0x47563d
push 1
lea ecx, [ebp - 0x28e4]
call fcn.00437a47
cmp dword [eax], 0
je 0x47563d
mov dword [ebp - 0x1d60], 1
jmp 0x475644
and dword [ebp - 0x1d60], 0
push 2
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov ecx, dword [ebp - 0x1d60]
sub ecx, dword [eax]
je 0x475667
mov dword [ebp - 0xe60], 1
jmp 0x47566e
and dword [ebp - 0xe60], 0
push 0
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov ecx, dword [ebp - 0xe60]
cmp ecx, dword [eax]
jle 0x475691
mov dword [ebp - 0x1d68], 1
jmp 0x475698
and dword [ebp - 0x1d68], 0
cmp dword [ebp - 0x1d68], 0xfffffffc
jne 0x4756ad
mov dword [ebp - 0xe68], 1
jmp 0x4756b4
and dword [ebp - 0xe68], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
add eax, dword [ebp - 0xe68]
cmp dword [ebp - 0x1d70], eax
jle 0x4756db
mov dword [ebp - 0xe70], 1
jmp 0x4756e2
and dword [ebp - 0xe70], 0
cmp dword [ebp - 0xe70], 4
ja 0x4756f7
mov dword [ebp - 0xe78], 1
jmp 0x4756fe
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x1d78]
cmp dword [ebp - 0xe78], eax
jne 0x475718
mov dword [ebp - 0x1d80], 1
jmp 0x47571f
and dword [ebp - 0x1d80], 0
mov eax, dword [ebp - 0x650]
cmp dword [ebp - 0x1d80], eax
je 0x475739
mov dword [ebp - 0xe80], 1
jmp 0x475740
and dword [ebp - 0xe80], 0
mov eax, dword [ebp - 0x554]
cmp dword [ebp - 0xe80], eax
jl 0x47575a
mov dword [ebp - 0x1d88], 1
jmp 0x475761
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x1d88]
sub eax, 6
jne 0x47577e
cmp dword [ebp - 0xc38], 0
jne 0x47577e
and dword [ebp - 0xe88], 0
jmp 0x475788
mov dword [ebp - 0xe88], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0xe88], eax
jl 0x4757a9
mov dword [ebp - 0x1d90], 1
jmp 0x4757b0
and dword [ebp - 0x1d90], 0
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xc80]
call fcn.00437a47
mov eax, dword [eax]
add eax, dword [ebp - 0x1d90]
cmp eax, dword [ebp - 0xe90]
jg 0x4757dd
mov dword [ebp - 0x1d98], 1
jmp 0x4757e4
and dword [ebp - 0x1d98], 0
mov eax, dword [ebp - 0x1d98]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xa38], eax
jg 0x47581d
mov byte [ebp - 0x3f1], 0
movzx eax, byte [ebp - 0x3f1]
test eax, eax
je 0x475818
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4759ef
mov dword [ebp - 0xb50], 0x1f666c83
mov dword [ebp - 0x8d4], 0
jmp 0x475840
mov eax, dword [ebp - 0x8d4]
inc eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 2
jge 0x47585c
mov eax, dword [ebp - 0x8d4]
mov dword [ebp + eax*4 - 0x2964], 0xffffffff
jmp 0x475833
cmp dword [ebp - 0xb50], 0x868b
je 0x475874
mov dword [ebp - 0xe98], 1
jmp 0x47587b
and dword [ebp - 0xe98], 0
cmp dword [ebp - 0xe98], 0xb334fe9d
je 0x475893
mov dword [ebp - 0x1da0], 1
jmp 0x47589a
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x554]
cmp dword [ebp - 0x1da0], eax
jl 0x4758b4
mov dword [ebp - 0xea0], 1
jmp 0x4758bb
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0xa38], eax
cmp dword [ebp - 0x330], 7
cmp dword [ebp - 0xb50], 0
jne 0x4758f0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2964], 0
jne 0x4758f0
and dword [ebp - 0x1da8], 0
jmp 0x4758fa
mov dword [ebp - 0x1da8], 1
cmp dword [ebp - 0x1da8], 0xffffffff
jg 0x47590f
mov dword [ebp - 0xea8], 1
jmp 0x475916
and dword [ebp - 0xea8], 0
cmp dword [ebp - 0xea8], 0x74f57033
jg 0x47592e
mov dword [ebp - 0x1db0], 1
jmp 0x475935
and dword [ebp - 0x1db0], 0
cmp dword [ebp - 0x1db0], 0x6909
jg 0x47594d
mov dword [ebp - 0xeb0], 1
jmp 0x475954
and dword [ebp - 0xeb0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2964]
add eax, dword [ebp - 0xeb0]
cmp dword [ebp - 0x554], eax
jne 0x47597b
mov dword [ebp - 0x1db8], 1
jmp 0x475982
and dword [ebp - 0x1db8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0x1db8], eax
je 0x4759a3
mov dword [ebp - 0x2578], 1
jmp 0x4759aa
and dword [ebp - 0x2578], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x340c], eax
mov eax, 0x7bb9
cmp eax, 0xffffffff
jl 0x4759d2
cmp dword [ebp - 0xb50], 0
jne 0x4759d2
and dword [ebp - 0xeb8], 0
jmp 0x4759dc
mov dword [ebp - 0xeb8], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xeb8]
mov dword [ebp + eax - 0xb10], ecx
jmp 0x475a07
cmp dword [ebp - 0x650], 0
je 0x475a07
lea ecx, [ebp - 0x28e4]
call fcn.00437a2b
jmp 0x475a17
lea ecx, [ebp - 0x28e4]
call fcn.00437a2b
jmp 0x4752ad
lea ecx, [ebp - 0xc80]
call fcn.00437a2b
mov dword [ebp - 0x266c], 0
push 2
lea ecx, [ebp - 0x26d0]
call fcn.00437959
mov dword [ebp - 0x414], 0xf46db505
mov dword [ebp - 0x2580], 1
mov dword [ebp - 0x31b0], 0xffffffff
mov dword [ebp - 0x804], 0
jmp 0x475a70
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 2
jge 0x475a92
push dword [ebp - 0x804]
lea ecx, [ebp - 0x26d0]
call fcn.00437a47
mov dword [eax], 0xd5e4
jmp 0x475a63
mov dword [ebp - 0x414], 1
jmp 0x475aab
mov eax, dword [ebp - 0x414]
dec eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
jl 0x475bb4
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x258], 0
jmp 0x475adb
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jg 0x475b84
push dword [ebp - 0x258]
lea ecx, [ebp - 0x26d0]
call fcn.00437a47
cmp dword [eax], 0
je 0x475b03
jmp 0x475b84
cmp dword [ebp - 0x258], 0
je 0x475b36
push dword [ebp - 0x258]
lea ecx, [ebp - 0x26d0]
call fcn.00437a47
mov esi, eax
push dword [ebp - 0x258]
lea ecx, [ebp - 0x26d0]
call fcn.00437a47
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x475b7f
mov byte [ebp - 0x2ce], 0
movzx eax, byte [ebp - 0x2ce]
test eax, eax
je 0x475b67
push 0
push 0
push 0x1db3
push 0
push 0x9e6
push 0
push 0x1e4a
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 0x2cf], 0
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x475b7f
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x475ace
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x475baf
push 0x1083
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
jmp 0x475a9e
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x3548], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x2580], eax
lea ecx, [ebp - 0x26d0]
call fcn.00437a2b
mov dword [ebp - 0x2974], 0xa5d6c05b
mov dword [ebp - 0x2970], 0xa5d6c05b
mov dword [ebp - 0x296c], 0xa5d6c05b
mov dword [ebp - 0x2968], 0xa5d6c05b
mov dword [ebp - 0x4dc], 0
push 2
lea ecx, [ebp - 0x2d24]
call fcn.00437959
mov dword [ebp - 0x464], 0xec3203b
mov dword [ebp - 0x658], 0
jmp 0x475c39
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 2
jge 0x475c5b
push dword [ebp - 0x658]
lea ecx, [ebp - 0x2d24]
call fcn.00437a47
mov dword [eax], 0xfffffffa
jmp 0x475c2c
mov dword [ebp - 0x4dc], 0
jmp 0x475c74
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 3
jg 0x475dbe
mov dword [ebp - 0x974], 1
mov dword [ebp - 0x2e28], 0xffffffff
mov dword [ebp - 0x210], 0
jmp 0x475cae
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x475cca
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x3810], 0x415d7249
jmp 0x475ca1
mov dword [ebp - 0x210], 0
jmp 0x475ce3
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x475cff
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x1dc0], 0xd49598aa
jmp 0x475cd6
mov dword [ebp - 0x974], 3
jmp 0x475d18
mov eax, dword [ebp - 0x974]
dec eax
mov dword [ebp - 0x974], eax
cmp dword [ebp - 0x974], 0
jl 0x475db9
mov dword [ebp - 0x2e30], 0x6e6f
mov dword [ebp - 0x2e38], 0x21f90ef3
mov dword [ebp - 0x2e40], 0xfffffffd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1dc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1dc0], eax
mov dword [ebp - 0x464], 1
jmp 0x475d77
mov eax, dword [ebp - 0x464]
dec eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
jl 0x475db4
mov eax, dword [ebp - 0x4dc]
mov ecx, dword [ebp - 0x464]
mov eax, dword [ebp + eax*4 - 0x2974]
mov dword [ebp + ecx*4 - 0x296c], eax
push dword [ebp - 0x464]
lea ecx, [ebp - 0x2d24]
call fcn.00437a47
cmp dword [eax], 0
je 0x475db2
jmp 0x475d6a
jmp 0x475d6a
jmp 0x475d0b
jmp 0x475c67
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x475ddd
push 0xe5d
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [ebp - 0x2d24]
call fcn.00437a2b
mov dword [ebp - 0x1d8], 0
jmp 0x475e01
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x475e23
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0xc08]
call fcn.00437a47
mov dword [eax], 0xfffffffb
jmp 0x475df4
mov dword [ebp - 0x41c], 9
mov dword [ebp - 0x2588], 0xd4df
mov dword [ebp - 0x160], 0xfffffffe
mov dword [ebp - 0x1de0], 9
mov dword [ebp - 0x2590], 1
push 1
lea ecx, [ebp - 0x32b4]
call fcn.00437959
mov dword [ebp - 0xee0], 0
mov dword [ebp - 0x130], 0
jmp 0x475e85
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x475ea1
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x36f8], 0xfffffff7
jmp 0x475e78
mov dword [ebp - 0x130], 0
jmp 0x475eba
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x475edc
push dword [ebp - 0x130]
lea ecx, [ebp - 0x32b4]
call fcn.00437a47
mov dword [eax], 0xfffffff9
jmp 0x475ead
mov dword [ebp - 0x41c], 0
jmp 0x475ef5
mov eax, dword [ebp - 0x41c]
dec eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0xffffffff
je 0x475fa9
push 3
lea ecx, [ebp - 0x2c40]
call fcn.00437959
mov dword [ebp - 0x598], 0xf2000252
mov dword [ebp - 0x660], 0
jmp 0x475f32
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 3
jge 0x475f51
push dword [ebp - 0x660]
lea ecx, [ebp - 0x2c40]
call fcn.00437a47
and dword [eax], 0
jmp 0x475f25
mov dword [ebp - 0x598], 2
jmp 0x475f6a
mov eax, dword [ebp - 0x598]
dec eax
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 0
jl 0x475f8d
push dword [ebp - 0x598]
lea ecx, [ebp - 0x2c40]
call fcn.00437a47
cmp dword [eax], 0
je 0x475f8b
jmp 0x475f8d
jmp 0x475f5d
mov eax, dword [ebp - 0x2588]
mov dword [ebp - 0x160], eax
lea ecx, [ebp - 0x2c40]
call fcn.00437a2b
jmp 0x475ee8
mov dword [ebp - 0x160], 0
jmp 0x475fc2
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x16
jle 0x4761ad
mov dword [ebp - 0x2598], 4
mov dword [ebp - 0x1dc8], 1
mov dword [ebp - 0x2e48], 6
mov dword [ebp - 0x2e50], 1
mov dword [ebp - 0x2e58], 0x848308fa
mov dword [ebp - 0x80c], 0
jmp 0x47601a
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 4
jge 0x476036
mov eax, dword [ebp - 0x80c]
mov dword [ebp + eax*4 - 0x3874], 0xfffffffd
jmp 0x47600d
cmp dword [ebp - 0x160], 0
je 0x476187
mov dword [ebp - 0xa40], 0xfffa
mov eax, 0x4c266d8f
test eax, eax
je 0x47607b
cmp dword [ebp - 0x1dc8], 0
je 0x47607b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x36f8], 0
je 0x47607b
mov dword [ebp - 0xec0], 1
jmp 0x476082
and dword [ebp - 0xec0], 0
mov eax, dword [ebp - 0xec0]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x1dc8], eax
je 0x4760a8
mov dword [ebp - 0xec8], 1
jmp 0x4760af
and dword [ebp - 0xec8], 0
cmp dword [ebp - 0xec8], 0xffffffff
je 0x4760c4
mov dword [ebp - 0x1dd0], 1
jmp 0x4760cb
and dword [ebp - 0x1dd0], 0
mov eax, dword [ebp - 0x1dd0]
sub eax, dword [ebp - 0xa40]
cmp eax, dword [ebp - 0x160]
jle 0x4760eb
mov dword [ebp - 0xed0], 1
jmp 0x4760f2
and dword [ebp - 0xed0], 0
mov eax, dword [ebp - 0xed0]
sub eax, dword [ebp - 0x1de0]
add eax, dword [ebp - 0x2590]
cmp eax, dword [ebp - 0x160]
jge 0x476118
mov dword [ebp - 0x1dd8], 1
jmp 0x47611f
and dword [ebp - 0x1dd8], 0
mov eax, dword [ebp - 0x160]
imul eax, dword [ebp - 0x1dd8]
cmp dword [ebp - 0x2598], eax
jg 0x476147
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x476147
mov dword [ebp - 0xed8], 1
jmp 0x47614e
and dword [ebp - 0xed8], 0
cmp dword [ebp - 0xed8], 0xcc32
jge 0x476166
mov dword [ebp - 0x25a0], 1
jmp 0x47616d
and dword [ebp - 0x25a0], 0
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x2ea4], eax
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x1de0], eax
jmp 0x4761a8
mov dword [ebp - 0x2eac], 0xd2afddf3
mov dword [ebp - 0x2eb4], 0x2dc870af
mov eax, dword [ebp - 0xee0]
inc eax
mov dword [ebp - 0xee0], eax
jmp 0x475fb5
lea ecx, [ebp - 0x32b4]
call fcn.00437a2b
mov dword [ebp - 0x1d8], 0
jmp 0x4761d1
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x4761ed
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xc90], 8
jmp 0x4761c4
mov dword [ebp - 0x4e4], 0xfffffffa
mov dword [ebp - 0x25a8], 0xffffffff
mov dword [ebp - 0x668], 0
jmp 0x47621a
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 2
jge 0x476236
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0xb1c], 3
jmp 0x47620d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb1c]
mov dword [ebp - 0x2ebc], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xb1c]
cmp dword [ebp + eax - 0xb1c], ecx
jge 0x476271
mov dword [ebp - 0x1de8], 1
jmp 0x476278
and dword [ebp - 0x1de8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb1c]
cmp dword [ebp - 0x1de8], eax
jge 0x476299
mov dword [ebp - 0xee8], 1
jmp 0x4762a0
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0xee8], eax
jge 0x4762ba
mov dword [ebp - 0x1df0], 1
jmp 0x4762c1
and dword [ebp - 0x1df0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb1c]
add eax, dword [ebp - 0x1df0]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xb1c]
jge 0x4762ef
mov dword [ebp - 0xef0], 1
jmp 0x4762f6
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0xef0]
mov dword [ebp - 0x25a8], eax
mov dword [ebp - 0x4e4], 0xe
jmp 0x47631b
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0xe
je 0x476343
mov dword [ebp - 0x25b0], 7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb1c]
mov dword [ebp - 0x25b0], eax
jmp 0x47630e
cmp dword [ebp - 0x138], 0
je 0x4763f4
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x138], eax
je 0x47636a
mov dword [ebp - 0xef8], 1
jmp 0x476371
and dword [ebp - 0xef8], 0
cmp dword [ebp - 0x138], 0
jne 0x476381
cmp dword [ebp - 0x138], 0
push 1
lea ecx, [ebp - 0xc08]
call fcn.00437a47
cmp dword [eax], 0xe7790660
je 0x4763a2
mov dword [ebp - 0x1df8], 1
jmp 0x4763a9
and dword [ebp - 0x1df8], 0
push 2
lea ecx, [ebp - 0xc08]
call fcn.00437a47
mov ecx, dword [ebp - 0x1df8]
cmp ecx, dword [eax]
jg 0x4763cc
mov dword [ebp - 0x1e00], 1
jmp 0x4763d3
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0xef8]
imul eax, dword [ebp - 0x1e00]
cmp eax, dword [ebp - 0x138]
je 0x4763f4
mov dword [ebp - 0x25b8], 1
jmp 0x4763fb
and dword [ebp - 0x25b8], 0
push 1
lea ecx, [ebp - 0xc08]
call fcn.00437a47
mov esi, dword [ebp - 0x138]
push 0
lea ecx, [ebp - 0xc08]
call fcn.00437a47
mov eax, dword [eax]
lea eax, [esi + eax + 3]
test eax, eax
jne 0x476431
mov dword [ebp - 0xf00], 1
jmp 0x476438
and dword [ebp - 0xf00], 0
cmp dword [ebp - 0xf00], 0xffffffff
ja 0x476465
push 2
lea ecx, [ebp - 0xc08]
call fcn.00437a47
cmp dword [eax], 0
jne 0x476465
mov eax, 0x5a7d
test eax, eax
jne 0x476465
and dword [ebp - 0x1e08], 0
jmp 0x47646f
mov dword [ebp - 0x1e08], 1
cmp dword [ebp - 0x1e08], 0xfffffffc
jl 0x476484
mov dword [ebp - 0xf08], 1
jmp 0x47648b
and dword [ebp - 0xf08], 0
cmp dword [ebp - 0xf08], 0x896e60be
je 0x4764a3
mov dword [ebp - 0x1e10], 1
jmp 0x4764aa
and dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x1e10]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x2ec4], eax
push 1
lea ecx, [ebp - 0xc08]
call fcn.00437a47
push 1
lea ecx, [ebp - 0xc08]
call fcn.00437a47
xor eax, eax
cmp eax, 1
ja 0x4764ef
mov dword [ebp - 0xf10], 1
jmp 0x4764f6
and dword [ebp - 0xf10], 0
cmp dword [ebp - 0xf10], 1
jne 0x47650b
mov dword [ebp - 0x25c0], 1
jmp 0x476512
and dword [ebp - 0x25c0], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x2ecc], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x1e18], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e18]
mov dword [ebp + eax - 0xc90], ecx
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x1e18], eax
jge 0x476557
mov dword [ebp - 0xf18], 1
jmp 0x47655e
and dword [ebp - 0xf18], 0
mov esi, dword [ebp - 0xf18]
sub esi, 0x6f9cbb95
push 1
lea ecx, [ebp - 0xc08]
call fcn.00437a47
cmp esi, dword [eax]
je 0x476587
mov dword [ebp - 0x1e20], 1
jmp 0x47658e
and dword [ebp - 0x1e20], 0
mov eax, dword [ebp - 0x1e20]
sub eax, dword [ebp - 0x350]
je 0x478b30
mov dword [ebp - 0x670], 1
push 1
lea ecx, [ebp - 0x28fc]
call fcn.00437959
mov dword [ebp - 0x8dc], 0
jmp 0x4765d0
mov eax, dword [ebp - 0x8dc]
inc eax
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 1
jge 0x4765ef
push dword [ebp - 0x8dc]
lea ecx, [ebp - 0x28fc]
call fcn.00437a47
and dword [eax], 0
jmp 0x4765c3
mov dword [ebp - 0x670], 0
jmp 0x476608
mov eax, dword [ebp - 0x670]
dec eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0xfffffffa
jne 0x47665b
mov dword [ebp - 0x814], 0xffffffff
push 0
lea ecx, [ebp - 0x28fc]
call fcn.00437a47
mov dword [eax], 7
cmp dword [ebp - 0x814], 0
jne 0x47663e
cmp dword [ebp - 0x814], 0
push 0
lea ecx, [ebp - 0x28fc]
call fcn.00437a47
mov ecx, dword [ebp - 0x814]
add ecx, dword [eax]
mov dword [ebp - 0x814], ecx
jmp 0x4765fb
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x47667a
push 0x21e5
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x28fc]
call fcn.00437a2b
mov dword [ebp - 0x1104], 0xac57
mov dword [ebp - 0x48c], 0xba394643
mov dword [ebp - 0x678], 0
jmp 0x4766b2
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 1
jge 0x4766ce
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0xf20], 0xc93
jmp 0x4766a5
mov dword [ebp - 0x48c], 0
jmp 0x4766e7
cmp dword [ebp - 0x48c], 0
jl 0x476716
mov eax, dword [ebp - 0x48c]
cmp dword [ebp + eax*4 - 0xf20], 0
je 0x476702
jmp 0x476716
mov eax, dword [ebp - 0x48c]
cmp dword [ebp + eax*4 - 0xf20], 0
je 0x476714
mov eax, 0xbbfe
test eax, eax
je 0x477e88
push 1
lea ecx, [ebp - 0xcf0]
call fcn.00437959
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x25d0], 0xbe3335a0
mov dword [ebp - 0x944], 0
jmp 0x47675a
mov dword [ebp - 0x4b4], 0xfffffffb
mov dword [ebp - 0x2bf0], 1
mov dword [ebp - 0x2bec], 1
mov dword [ebp - 0x2be8], 1
mov dword [ebp - 0x2be4], 1
lea ecx, [ebp - 0xbbd]
call fcn.00437a56
push eax
lea eax, [ebp - 0x2be0]
push eax
lea eax, [ebp - 0x2bf0]
push eax
lea ecx, [ebp - 0x3700]
call fcn.00437a59
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x32c4]
call fcn.00437a05
mov dword [ebp - 0x4b4], 0xb
jmp 0x477f08
push 2
lea ecx, [ebp - 0x2700]
call fcn.00437959
mov dword [ebp - 0x434], 0xf46db505
mov dword [ebp - 0x2698], 1
mov dword [ebp - 0x3064], 0xffffffff
mov dword [ebp - 0x8ec], 0
jmp 0x478b74
mov eax, dword [ebp - 0x8ec]
inc eax
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x8ec], 2
jge 0x478b96
push dword [ebp - 0x8ec]
lea ecx, [ebp - 0x2700]
call fcn.00437a47
mov dword [eax], 0xd5e4
jmp 0x478b67
mov dword [ebp - 0x434], 1
jmp 0x478baf
mov eax, dword [ebp - 0x434]
dec eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jl 0x478cb8
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - 0x260], 0
jmp 0x478bdf
cmp dword [ebp - 0x260], 1
jg 0x478c88
push dword [ebp - 0x260]
lea ecx, [ebp - 0x2700]
call fcn.00437a47
cmp dword [eax], 0
je 0x478c07
jmp 0x478c88
cmp dword [ebp - 0x260], 0
je 0x478c3a
push dword [ebp - 0x260]
lea ecx, [ebp - 0x2700]
call fcn.00437a47
mov esi, eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x2700]
call fcn.00437a47
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x478c83
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x478c6b
push 0
push 0
push 0x1db3
push 0
push 0x9e6
push 0
push 0x1e4a
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [ebp - 0x2eb], 0
movzx eax, byte [ebp - 0x2eb]
test eax, eax
je 0x478c83
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x478bd2
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x478cb3
push 0x1083
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
jmp 0x478ba2
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x306c], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x2698], eax
lea ecx, [ebp - 0x2700]
call fcn.00437a2b
mov dword [ebp - 0xb88], 0x9fa6
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x6b0], 0
jmp 0x478d08
mov eax, dword [ebp - 0x6b0]
inc eax
mov dword [ebp - 0x6b0], eax
cmp dword [ebp - 0x6b0], 3
jge 0x478d24
mov eax, dword [ebp - 0x6b0]
mov dword [ebp + eax*4 - 0x3834], 0
jmp 0x478cfb
mov dword [ebp - 0x834], 0
jmp 0x478d3d
mov eax, dword [ebp - 0x834]
inc eax
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 2
jg 0x478d69
mov byte [ebp - 0x2ef], 0
movzx eax, byte [ebp - 0x2ef]
test eax, eax
je 0x478d67
push 0
push 0x2072
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
jmp 0x478d30
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x478d83
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov dword [ebp - 0x6e8], 0x1ab372c2
mov dword [ebp - 0x4fc], 0xfffffffb
mov dword [ebp - 0x2b78], 1
mov dword [ebp - 0x2b74], 1
mov dword [ebp - 0x2b70], 1
mov dword [ebp - 0x2b6c], 1
lea ecx, [ebp - 0xaf1]
call fcn.00437a56
push eax
lea eax, [ebp - 0x2b68]
push eax
lea eax, [ebp - 0x2b78]
push eax
lea ecx, [ebp - 0x3730]
call fcn.00437a59
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x32f4]
call fcn.00437a05
mov dword [ebp - 0x4fc], 0xb
jmp 0x478e0d
cmp dword [ebp - 0x4fc], 0xfffffff9
jg 0x478e5a