Function at 0x473230
Capabilities:
Accept command line arguments
Clear file content
Create thread
Delete registry key
Get common file path
Get memory capacity
Get session user name
Hide graphical window
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37ac
call fcn.004ab120
push esi
push edi
mov dword [ebp - 0x980], 0xfffffffe
mov dword [ebp - 0x233c], 0xcb03629a
mov byte [ebp - 0x3f8], 0
movzx eax, byte [ebp - 0x3f8]
test eax, eax
je 0x473271
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [ebp - 0x980], 2
jmp 0x47328a
mov eax, dword [ebp - 0x980]
dec eax
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 0xfffffff6
jge 0x4732c2
mov dword [ebp - 0x2278], 0xffffffff
mov dword [ebp - 0x24f8], 1
mov eax, dword [ebp - 0x2278]
inc eax
mov dword [ebp - 0x2278], eax
mov eax, dword [ebp - 0x233c]
mov dword [ebp - 0x24f8], eax
jmp 0x47327d
mov dword [ebp - 0x4e8], 0xfffffff9
mov dword [ebp - 0x2148], 2
mov dword [ebp - 0x2500], 0x5761be36
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x473306
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
mov dword [ebp - 0x4e8], 0
jmp 0x47331f
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0xffffffee
jne 0x473468
mov dword [ebp - 0x20e0], 0xd21f1eb3
mov dword [ebp - 0x9cc], 0xfffffffb
mov dword [ebp - 0x20e8], 0xb5411457
mov byte [ebp - 0x2c2], 0
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x47336b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
cmp dword [ebp - 0x20e0], 0
jne 0x4733fa
cmp dword [ebp - 0x9cc], 0x890c5440
je 0x473390
mov dword [ebp - 0x20d0], 1
jmp 0x473397
and dword [ebp - 0x20d0], 0
cmp dword [ebp - 0x20d0], 0xee76373a
je 0x4733af
mov dword [ebp - 0x20d8], 1
jmp 0x4733b6
and dword [ebp - 0x20d8], 0
mov eax, dword [ebp - 0x20d8]
mov dword [ebp - 0x20e8], eax
mov eax, dword [ebp - 0x20e0]
cmp dword [ebp - 0x20e8], eax
jg 0x4733dc
mov dword [ebp - 0x20f0], 1
jmp 0x4733e3
and dword [ebp - 0x20f0], 0
mov eax, dword [ebp - 0x9cc]
cmp eax, dword [ebp - 0x20f0]
jge 0x4733fa
and dword [ebp - 0x20f8], 0
jmp 0x473404
mov dword [ebp - 0x20f8], 1
mov eax, dword [ebp - 0x9cc]
cmp dword [ebp - 0x20f8], eax
jle 0x47341e
mov dword [ebp - 0x2100], 1
jmp 0x473425
and dword [ebp - 0x2100], 0
mov eax, dword [ebp - 0x2100]
mov dword [ebp - 0x2148], eax
mov eax, 0x801fc3ee
sub eax, dword [ebp - 0x2148]
cmp dword [ebp - 0x4e8], eax
jg 0x473450
mov dword [ebp - 0x2150], 1
jmp 0x473457
and dword [ebp - 0x2150], 0
mov eax, dword [ebp - 0x2150]
mov dword [ebp - 0x2500], eax
jmp 0x473312
push 3
lea ecx, [ebp - 0xbf4]
call fcn.00434460
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x2520], 0x367f5ed9
mov dword [ebp - 0x2518], 0xa20b
mov dword [ebp - 0x988], 0
jmp 0x4734ac
mov eax, dword [ebp - 0x988]
inc eax
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x988], 3
jge 0x4734ce
push dword [ebp - 0x988]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
mov dword [eax], 0xfffffff6
jmp 0x47349f
mov dword [ebp - 0xb0], 0
jmp 0x4734e7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jg 0x4736da
mov dword [ebp - 0x2160], 0xfffffff8
mov dword [ebp - 0x2510], 0xc3a60813
mov dword [ebp - 0x2528], 0xffffffff
mov dword [ebp - 0x990], 0
jmp 0x47352b
mov eax, dword [ebp - 0x990]
inc eax
mov dword [ebp - 0x990], eax
cmp dword [ebp - 0x990], 2
jge 0x473547
mov eax, dword [ebp - 0x990]
mov dword [ebp + eax*4 - 0x2dac], 5
jmp 0x47351e
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
cmp dword [eax], 0
jne 0x473569
mov dword [ebp - 0x2158], 1
jmp 0x473570
and dword [ebp - 0x2158], 0
cmp dword [ebp - 0x2158], 0x4f5ac3d6
jl 0x473588
mov dword [ebp - 0x2508], 1
jmp 0x47358f
and dword [ebp - 0x2508], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
mov eax, dword [eax]
mov dword [ebp - 0x2160], eax
mov esi, dword [ebp - 0x2160]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
imul esi, dword [eax]
add esi, 0xffff
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
cmp dword [eax], esi
je 0x47360b
mov dword [ebp - 0x2168], 1
jmp 0x473612
and dword [ebp - 0x2168], 0
mov eax, dword [ebp - 0x2510]
cmp dword [ebp - 0x2168], eax
jge 0x47362c
mov dword [ebp - 0x2170], 1
jmp 0x473633
and dword [ebp - 0x2170], 0
mov eax, dword [ebp - 0x2518]
cmp eax, dword [ebp - 0x2170]
je 0x47364d
mov dword [ebp - 0x2178], 1
jmp 0x473654
and dword [ebp - 0x2178], 0
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
mov ecx, dword [ebp - 0x2178]
cmp ecx, dword [eax]
jg 0x47367b
mov dword [ebp - 0xaf8], 1
jmp 0x473682
and dword [ebp - 0xaf8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp + eax - 0x2dac], ecx
mov esi, dword [ebp - 0x2520]
add esi, dword [ebp - 0xaf8]
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xbf4]
call fcn.0043454e
cmp dword [eax], esi
je 0x4736c2
mov dword [ebp - 0x2180], 1
jmp 0x4736c9
and dword [ebp - 0x2180], 0
mov eax, dword [ebp - 0x2180]
mov dword [ebp - 0x2528], eax
jmp 0x4734da
lea ecx, [ebp - 0xbf4]
call fcn.00434532
mov dword [ebp - 0x634], 0xfffffffe
mov dword [ebp - 0x414], 1
mov dword [ebp - 0x21a0], 0x41145714
mov dword [ebp - 0x2e30], 0x4af7bdd4
mov dword [ebp - 0x3480], 0x74fd5228
mov dword [ebp - 0x414], 0
jmp 0x473730
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xa
jge 0x4739fe
mov dword [ebp - 0x21c0], 0x56a9
mov dword [ebp - 0x4ac], 0x81d21f1e
mov dword [ebp - 0x2530], 0x54dbbe56
mov dword [ebp - 0x30d8], 0xffffffff
mov dword [ebp - 0x3330], 0
mov dword [ebp - 0x30e0], 0x63ec58f5
mov dword [ebp - 0x3538], 0x39cee24b
mov dword [ebp - 0x914], 0
jmp 0x47379c
mov eax, dword [ebp - 0x914]
inc eax
mov dword [ebp - 0x914], eax
cmp dword [ebp - 0x914], 4
jge 0x4737b8
mov eax, dword [ebp - 0x914]
mov dword [ebp + eax*4 - 0x36b4], 0xdb8846b5
jmp 0x47378f
cmp dword [ebp - 0x2530], 1
jge 0x4737cd
mov dword [ebp - 0x2188], 1
jmp 0x4737d4
and dword [ebp - 0x2188], 0
cmp dword [ebp - 0x2188], 0x6373
jg 0x4737ec
mov dword [ebp - 0x2190], 1
jmp 0x4737f3
and dword [ebp - 0x2190], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x2190], eax
jg 0x47380d
mov dword [ebp - 0x2198], 1
jmp 0x473814
and dword [ebp - 0x2198], 0
mov eax, dword [ebp - 0x2198]
mov dword [ebp - 0x21a0], eax
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x21a0], eax
jg 0x47383a
mov dword [ebp - 0x21a8], 1
jmp 0x473841
and dword [ebp - 0x21a8], 0
mov eax, dword [ebp - 0x21c0]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x21a8]
je 0x473867
mov dword [ebp - 0x21b0], 1
jmp 0x47386e
and dword [ebp - 0x21b0], 0
cmp dword [ebp - 0x21b0], 0xffff
jne 0x473886
mov dword [ebp - 0x21b8], 1
jmp 0x47388d
and dword [ebp - 0x21b8], 0
cmp dword [ebp - 0x21b8], 0x801fc3ee
je 0x4738a5
mov dword [ebp - 0x21c8], 1
jmp 0x4738ac
and dword [ebp - 0x21c8], 0
mov eax, dword [ebp - 0x21c0]
cmp eax, dword [ebp - 0x21c8]
jg 0x4739b5
mov dword [ebp - 0xb60], 8
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x4738e9
push 0
push 0x15c8
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x4ac], 9
jmp 0x473902
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0x15
jne 0x4739b3
mov dword [ebp - 0x30e8], 0
mov dword [ebp - 0x614], 0
jmp 0x473932
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 4
jge 0x47394e
mov eax, dword [ebp - 0x614]
mov dword [ebp + eax*4 - 0x3684], 0xffffffff
jmp 0x473925
mov byte [ebp - 0x2c6], 0
movzx eax, byte [ebp - 0x2c6]
test eax, eax
je 0x473966
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp - 0xb60]
dec eax
mov dword [ebp - 0xb60], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3684]
cmp dword [ebp - 0xb60], eax
jle 0x473994
mov dword [ebp - 0x21d0], 1
jmp 0x47399b
and dword [ebp - 0x21d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x21d0]
mov dword [ebp + eax - 0x36b4], ecx
jmp 0x4738f5
jmp 0x4739dd
mov byte [ebp - 0x2c8], 0
movzx eax, byte [ebp - 0x2c8]
test eax, eax
je 0x4739dd
push 0
push 0
push 0x20d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
test eax, eax
je 0x4739f9
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x473723
mov dword [ebp - 0x2624], 0xcb03629a
push 2
lea ecx, [ebp - 0x2298]
call fcn.00434460
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x130], 0
jmp 0x473a38
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x473a5a
push dword [ebp - 0x130]
lea ecx, [ebp - 0x2298]
call fcn.0043454e
mov dword [eax], 0xb0f73838
jmp 0x473a2b
mov dword [ebp - 0x130], 0
jmp 0x473a73
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x473a8f
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x2db8], 0xfecf7921
jmp 0x473a66
push 0
lea ecx, [ebp - 0x2298]
call fcn.0043454e
and dword [eax], 0
push 0
lea ecx, [ebp - 0x2298]
call fcn.0043454e
mov eax, dword [eax]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0
jne 0x473b57
mov dword [ebp - 0x568], 0x62a2
push 0
lea ecx, [ebp - 0x2298]
call fcn.0043454e
mov eax, dword [eax]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0xffffffff
je 0x473af5
mov dword [ebp - 0x21d8], 1
jmp 0x473afc
and dword [ebp - 0x21d8], 0
cmp dword [ebp - 0x21d8], 0x50f8
je 0x473b14
mov dword [ebp - 0x21e0], 1
jmp 0x473b1b
and dword [ebp - 0x21e0], 0
push 0
lea ecx, [ebp - 0x2298]
call fcn.0043454e
mov ecx, dword [ebp - 0x21e0]
cmp ecx, dword [eax]
jg 0x473b3e
mov dword [ebp - 0x21f4], 1
jmp 0x473b45
and dword [ebp - 0x21f4], 0
cmp dword [ebp - 0x21f4], 9
jg 0x473b57
and dword [ebp - 0x21fc], 0
jmp 0x473b61
mov dword [ebp - 0x21fc], 1
push 1
lea ecx, [ebp - 0x2298]
call fcn.0043454e
mov ecx, dword [ebp - 0x21fc]
cmp ecx, dword [eax]
je 0x473b84
mov dword [ebp - 0x2204], 1
jmp 0x473b8b
and dword [ebp - 0x2204], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2204]
mov dword [ebp + eax - 0x2db8], ecx
lea ecx, [ebp - 0x2298]
call fcn.00434532
mov dword [ebp - 0xb68], 0xfffffffe
push 4
lea ecx, [ebp - 0x4cc]
call fcn.00434460
push 1
lea ecx, [ebp - 0x273c]
call fcn.00434460
mov dword [ebp - 0x4b4], 0x58069d1f
mov dword [ebp - 0x2548], 0xb1ca
push 1
lea ecx, [ebp - 0x2988]
call fcn.00434460
mov dword [ebp - 0x3340], 1
mov dword [ebp - 0x70], 0
jmp 0x473c08
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x473c24
push dword [ebp - 0x70]
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov dword [eax], 0x9ddcef98
jmp 0x473c01
mov dword [ebp - 0x70], 0
jmp 0x473c34
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x473c4d
push dword [ebp - 0x70]
lea ecx, [ebp - 0x273c]
call fcn.0043454e
and dword [eax], 0
jmp 0x473c2d
mov dword [ebp - 0x70], 0
jmp 0x473c5d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x473c79
push dword [ebp - 0x70]
lea ecx, [ebp - 0x2988]
call fcn.0043454e
mov dword [eax], 0x1448afe0
jmp 0x473c56
push 2
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
cmp dword [eax], 0xffff5cef
jg 0x473c9a
mov dword [ebp - 0x222c], 1
jmp 0x473ca1
and dword [ebp - 0x222c], 0
push 1
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov esi, eax
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x473cde
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
cmp dword [eax], 0
jne 0x473cde
and dword [ebp - 0x220c], 0
jmp 0x473ce8
mov dword [ebp - 0x220c], 1
cmp dword [ebp - 0x220c], 0x9eb1
jge 0x473d00
mov dword [ebp - 0x2214], 1
jmp 0x473d07
and dword [ebp - 0x2214], 0
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov esi, dword [ebp - 0x2214]
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
cmp esi, dword [eax]
jg 0x473d39
mov dword [ebp - 0x221c], 1
jmp 0x473d40
and dword [ebp - 0x221c], 0
cmp dword [ebp - 0x221c], 0xedaa
jne 0x473d58
mov dword [ebp - 0x2224], 1
jmp 0x473d5f
and dword [ebp - 0x2224], 0
push 0
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov ecx, dword [ebp - 0x2224]
cmp ecx, dword [eax]
jg 0x473d82
mov dword [ebp - 0x2284], 1
jmp 0x473d89
and dword [ebp - 0x2284], 0
mov eax, dword [ebp - 0x222c]
cmp eax, dword [ebp - 0x2284]
jge 0x473da3
mov dword [ebp - 0x228c], 1
jmp 0x473daa
and dword [ebp - 0x228c], 0
push 0
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov ecx, dword [ebp - 0x228c]
cmp ecx, dword [eax]
jge 0x473dcd
mov dword [ebp - 0x2258], 1
jmp 0x473dd4
and dword [ebp - 0x2258], 0
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov ecx, dword [ebp - 0x2258]
cmp ecx, dword [eax]
jl 0x473df7
mov dword [ebp - 0xcb8], 1
jmp 0x473dfe
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xcb8]
inc eax
mov dword [ebp - 0x1a50], eax
push 0
lea ecx, [ebp - 0x273c]
call fcn.0043454e
mov ecx, dword [ebp - 0x1a50]
mov dword [eax], ecx
cmp dword [ebp - 0x1a50], 0
je 0x473e3b
push 0
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
cmp dword [eax], 0
jne 0x473e68
push 0
lea ecx, [ebp - 0x273c]
call fcn.0043454e
cmp dword [eax], 0
jne 0x473e68
push 0
lea ecx, [ebp - 0x273c]
call fcn.0043454e
cmp dword [eax], 0
jne 0x473e68
and dword [ebp - 0xcc0], 0
jmp 0x473e72
mov dword [ebp - 0xcc0], 1
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x4b4], eax
mov esi, dword [ebp - 0x4b4]
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
cmp esi, dword [eax]
jge 0x473ea1
mov dword [ebp - 0x2538], 1
jmp 0x473ea8
and dword [ebp - 0x2538], 0
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov eax, 0x7fd8b26d
cmp eax, 0xffffffff
ja 0x473ecb
mov dword [ebp - 0x1a58], 1
jmp 0x473ed2
and dword [ebp - 0x1a58], 0
push 2
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov ecx, dword [ebp - 0x1a58]
cmp ecx, dword [eax]
jg 0x473ef5
mov dword [ebp - 0x2540], 1
jmp 0x473efc
and dword [ebp - 0x2540], 0
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov eax, dword [ebp - 0x2548]
mov dword [ebp - 0x30f0], eax
mov eax, 0x650e
test eax, eax
je 0x473f3c
push 3
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
cmp dword [eax], 0
je 0x473f3c
mov dword [ebp - 0xcc8], 1
jmp 0x473f43
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0xb68]
add eax, dword [ebp - 0xcc8]
imul eax, eax, 0xfff8
mov dword [ebp - 0x2550], eax
push 2
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov eax, dword [eax]
mov dword [ebp - 0x25dc], eax
mov eax, dword [ebp - 0xb68]
dec eax
mov dword [ebp - 0xb68], eax
mov eax, dword [ebp - 0x2550]
cmp eax, dword [ebp - 0x25dc]
jg 0x473f97
mov dword [ebp - 0x1a60], 1
jmp 0x473f9e
and dword [ebp - 0x1a60], 0
push 0
lea ecx, [ebp - 0x2988]
call fcn.0043454e
mov ecx, dword [ebp - 0x1a60]
cmp ecx, dword [eax]
jge 0x473fc1
mov dword [ebp - 0xcd0], 1
jmp 0x473fc8
and dword [ebp - 0xcd0], 0
push 1
lea ecx, [ebp - 0x4cc]
call fcn.0043454e
mov ecx, dword [ebp - 0xcd0]
cmp ecx, dword [eax]
jge 0x473feb
mov dword [ebp - 0x1a68], 1
jmp 0x473ff2
and dword [ebp - 0x1a68], 0
push 0
lea ecx, [ebp - 0x2988]
call fcn.0043454e
mov ecx, dword [ebp - 0x1a68]
sub ecx, dword [eax]
jne 0x474012
mov eax, 0xfffc
test eax, eax
je 0x47407a
mov byte [ebp - 0x2cc], 0
movzx eax, byte [ebp - 0x2cc]
test eax, eax
je 0x47402c
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [ebp - 0x4b4], 0
jmp 0x474045
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 3
jg 0x474075
mov byte [ebp - 0x2ce], 0
movzx eax, byte [ebp - 0x2ce]
test eax, eax
je 0x474073
push 0
push 0
push 0x22a7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x474038
jmp 0x47418f
mov dword [ebp - 0x3488], 1
mov dword [ebp - 0x30f8], 0x4d237656
mov dword [ebp - 0x3350], 0xfffffffd
mov dword [ebp - 0x3100], 0xffffffff
mov dword [ebp - 0x34e8], 0
mov dword [ebp - 0x3108], 1
mov dword [ebp - 0x3360], 1
mov dword [ebp - 0x2d94], 0xf47dfb07
mov dword [ebp - 0x2d98], 0
mov dword [ebp - 0x2da0], 5
mov dword [ebp - 0x2e1c], 0xffffffff
mov dword [ebp - 0x2e24], 0xfffffff9
mov dword [ebp - 0x2e2c], 0x4175c8fe
mov dword [ebp - 0x2e34], 5
mov dword [ebp - 0x2e3c], 0xaa2eedf2
mov dword [ebp - 0x2b2c], 0x15aca64a
mov dword [ebp - 0x2b28], 0x15aca64a
mov dword [ebp - 0x2b24], 0x15aca64a
mov dword [ebp - 0x2b20], 0x15aca64a
lea ecx, [ebp - 0xb55]
call fcn.0043455d
push eax
lea eax, [ebp - 0x2b1c]
push eax
lea eax, [ebp - 0x2b2c]
push eax
lea ecx, [ebp - 0x36fc]
call fcn.00434560
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3598]
call fcn.0043450c
mov dword [ebp - 0xcd8], 0x6311
mov eax, dword [ebp - 0xcd8]
dec eax
mov dword [ebp - 0xcd8], eax
lea ecx, [ebp - 0x3598]
call fcn.00434532
lea ecx, [ebp - 0x2988]
call fcn.00434532
lea ecx, [ebp - 0x273c]
call fcn.00434532
lea ecx, [ebp - 0x4cc]
call fcn.00434532
mov byte [ebp - 0x2d0], 0
mov dword [ebp - 0xf8], 6
mov dword [ebp - 0xce0], 0x1f6f0842
mov dword [ebp - 0x2e8], 4
mov dword [ebp - 0x1e0], 0xffffffff
push 3
lea ecx, [ebp - 0x22d4]
call fcn.00434460
mov dword [ebp - 0x844], 0
jmp 0x474205
mov eax, dword [ebp - 0x844]
inc eax
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 3
jge 0x474227
push dword [ebp - 0x844]
lea ecx, [ebp - 0x22d4]
call fcn.0043454e
mov dword [eax], 0x9c2d621e
jmp 0x4741f8
mov eax, dword [ebp - 0xf8]
sub eax, 0x2fa4588e
je 0x4742c2
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xf8], eax
jl 0x474252
mov dword [ebp - 0x1a70], 1
jmp 0x474259
and dword [ebp - 0x1a70], 0
mov eax, dword [ebp - 0x1a70]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x2e44], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2e4c], eax
cmp dword [ebp - 0x2e8], 0x1ea6
jge 0x474297
or eax, 0xffffffff
jne 0x474297
and dword [ebp - 0x1a78], 0
jmp 0x4742a1
mov dword [ebp - 0x1a78], 1
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x1a78], eax
jle 0x4742bb
mov dword [ebp - 0xce8], 1
jmp 0x4742c2
and dword [ebp - 0xce8], 0
mov dword [ebp - 0x1e0], 8
mov dword [ebp - 0x2e8], 0
jmp 0x4742e5
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 2
jg 0x474561
push 4
lea ecx, [ebp - 0x2c90]
call fcn.00434460
mov dword [ebp - 0x61c], 0
jmp 0x474318
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 4
jge 0x47433a
push dword [ebp - 0x61c]
lea ecx, [ebp - 0x2c90]
call fcn.0043454e
mov dword [eax], 4
jmp 0x47430b
mov dword [ebp - 0x1e0], 0
jmp 0x474353
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jg 0x474551
mov dword [ebp - 0x1a80], 0x2448
mov dword [ebp - 0xcf0], 0xe784b52d
mov dword [ebp - 0xcf8], 0xd28e4879
mov dword [ebp - 0xf8], 0
jmp 0x474397
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x47454c
mov dword [ebp - 0x25e4], 0x59f89f2e
mov dword [ebp - 0x84c], 0
jmp 0x4743c7
mov eax, dword [ebp - 0x84c]
inc eax
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 2
jge 0x4743e3
mov eax, dword [ebp - 0x84c]
mov dword [ebp + eax*4 - 0x2dc4], 0xc8e4c12f
jmp 0x4743ba
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x22d4]
call fcn.0043454e
mov ecx, dword [ebp - 0x25e4]
cmp dword [eax], ecx
jl 0x47440a
mov dword [ebp - 0x25ec], 1
jmp 0x474411
and dword [ebp - 0x25ec], 0
mov eax, dword [ebp - 0x1a80]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x1a80]
cmp dword [ebp - 0xcf0], eax
jl 0x47444d
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x22d4]
call fcn.0043454e
cmp dword [eax], 0
je 0x47444d
mov dword [ebp - 0x1a88], 1
jmp 0x474454
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1a88]
mov dword [ebp - 0xcf8], eax
mov esi, dword [ebp - 0xcf8]
push 1
lea ecx, [ebp - 0x22d4]
call fcn.0043454e
sub esi, dword [eax]
cmp esi, 0x449e
jl 0x474489
mov dword [ebp - 0x1a90], 1
jmp 0x474490
and dword [ebp - 0x1a90], 0
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x22d4]
call fcn.0043454e
mov eax, dword [eax]
sub eax, dword [ebp - 0x1a90]
jne 0x4744ca
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x22d4]
call fcn.0043454e
cmp dword [eax], 0
jne 0x4744ca
and dword [ebp - 0xd00], 0
jmp 0x4744d4
mov dword [ebp - 0xd00], 1
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xd00], eax
jle 0x4744f4
cmp dword [ebp - 0xf8], 0
jne 0x4744f4
and dword [ebp - 0x1a98], 0
jmp 0x4744fe
mov dword [ebp - 0x1a98], 1
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x1a98], eax
jl 0x474518
mov dword [ebp - 0xb70], 1
jmp 0x47451f
and dword [ebp - 0xb70], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb70]
mov dword [ebp + eax - 0x2dc4], ecx
push 0
lea ecx, [ebp - 0x2c90]
call fcn.0043454e
mov ecx, dword [ebp - 0xb70]
mov dword [eax], ecx
jmp 0x47438a
jmp 0x474346
lea ecx, [ebp - 0x2c90]
call fcn.00434532
jmp 0x4742d8
lea ecx, [ebp - 0x22d4]
call fcn.00434532
movzx eax, byte [ebp - 0x2d0]
test eax, eax
je 0x47468f
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x624], 0
jmp 0x47459e
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 4
jge 0x4745ba
mov eax, dword [ebp - 0x624]
mov dword [ebp + eax*4 - 0x3780], 0
jmp 0x474591
mov dword [ebp - 0x854], 0xb
jmp 0x4745d3
mov eax, dword [ebp - 0x854]
inc eax
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0x11
je 0x474655
mov dword [ebp - 0x62c], 0xfffffff6
mov byte [ebp - 0x2d2], 0
movzx eax, byte [ebp - 0x2d2]
test eax, eax
je 0x4745fe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x62c], 3
jmp 0x474617
mov eax, dword [ebp - 0x62c]
dec eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 0
jl 0x474650
mov dword [ebp - 0x25f4], 0x4f147909
mov byte [ebp - 0x2d4], 0
movzx eax, byte [ebp - 0x2d4]
test eax, eax
je 0x474644
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov dword [ebp - 0x25f4], 5
jmp 0x47460a
jmp 0x4745c6
mov byte [ebp - 0x2d6], 0
movzx eax, byte [ebp - 0x2d6]
test eax, eax
je 0x474683
push 0x1bb2
push 0x123
push 0x850
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [ebp - 0x4a8], 5
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x4a8], 0xd
jmp 0x4746c6
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0x19
je 0x474945
mov dword [ebp - 0x2f8], 0xfffffffe
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x34f8], 1
mov dword [ebp - 0x34f4], 1
mov dword [ebp - 0x34f0], 1
mov dword [ebp - 0x34ec], 1
mov eax, dword [ebp - 0x41c]
add eax, 0xffff
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x2f0], eax
jle 0x47473a
mov dword [ebp - 0xd08], 1
jmp 0x474741
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x4a8]
add eax, dword [ebp - 0xd08]
jne 0x474761
cmp dword [ebp - 0x2f0], 0
jne 0x474761
and dword [ebp - 0x1aa0], 0
jmp 0x47476b
mov dword [ebp - 0x1aa0], 1
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x1aa0], eax
jle 0x474785
mov dword [ebp - 0xd10], 1
jmp 0x47478c
and dword [ebp - 0xd10], 0
cmp dword [ebp - 0xd10], 0x3271
je 0x4747a4
mov dword [ebp - 0x1aa8], 1
jmp 0x4747ab
and dword [ebp - 0x1aa8], 0
cmp dword [ebp - 0x1aa8], 0xfffffffb
jne 0x4747c0
mov dword [ebp - 0xd18], 1
jmp 0x4747c7
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0x2f8]
imul ecx, dword [ebp - 0xd18], 0xa218
add eax, ecx
add eax, dword [ebp - 0x49c]
imul eax, eax, 0xa2c7
test eax, eax
je 0x474872
cmp dword [ebp - 0x4a8], 0
je 0x474872
push 2
lea ecx, [ebp - 0x2c30]
call fcn.00434460
mov dword [ebp - 0x85c], 0
jmp 0x47481c
mov eax, dword [ebp - 0x85c]
inc eax
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 2
jge 0x47483e
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x2c30]
call fcn.0043454e
mov dword [eax], 0xa30b
jmp 0x47480f
push 0
lea ecx, [ebp - 0x2c30]
call fcn.0043454e
mov dword [ebp - 0x1ab0], eax
mov eax, dword [ebp - 0x1ab0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1ab0]
mov dword [ecx], eax
lea ecx, [ebp - 0x2c30]
call fcn.00434532
jmp 0x474940
mov dword [ebp - 0x2f0], 0
jmp 0x47488b
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jg 0x474932
mov dword [ebp - 0x41c], 0x31d80
mov dword [ebp - 0x2f8], 3
jmp 0x4748bb
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0
jl 0x47492d
mov dword [ebp - 0x41c], 0
jmp 0x4748dd
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 3
jg 0x47492b
mov dword [ebp - 0x49c], 0
jmp 0x4748ff
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 3
jg 0x474929
mov byte [ebp - 0x2d8], 0
movzx eax, byte [ebp - 0x2d8]
test eax, eax
je 0x474927
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
jmp 0x4748f2
jmp 0x4748d0
jmp 0x4748ae
jmp 0x47487e
cmp dword [ebp - 0x2f8], 0
je 0x474940
jmp 0x4746b9
jmp 0x4746b9
mov dword [ebp - 0x634], 2
jmp 0x47495e
mov eax, dword [ebp - 0x634]
dec eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0xfffffff6
jge 0x474f54
mov dword [ebp - 0x138], 0x3fcb50bf
mov dword [ebp - 0x260c], 0x283d
mov dword [ebp - 0x864], 0
jmp 0x474998
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 4
jge 0x4749b4
mov eax, dword [ebp - 0x864]
mov dword [ebp + eax*4 - 0x350c], 0xa8eac8b
jmp 0x47498b
mov dword [ebp - 0x138], 0
jmp 0x4749cd
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x474a04
mov eax, dword [ebp - 0x138]
cmp dword [ebp + eax*4 - 0x350c], 0
je 0x4749e8
jmp 0x474a04
mov byte [ebp - 0x2da], 0
movzx eax, byte [ebp - 0x2da]
test eax, eax
je 0x474a02
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x4749c0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x350c], 0
je 0x474a3a
mov byte [ebp - 0x2dc], 0
movzx eax, byte [ebp - 0x2dc]
test eax, eax
je 0x474a35
push 0x1fcd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x474b68
mov dword [ebp - 0x25fc], 0xf7f3
mov dword [ebp - 0xd28], 0xfffffffd
mov dword [ebp - 0x2604], 0xffffffff
mov dword [ebp - 0x138], 0xffffffe3
jmp 0x474a71
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xc
je 0x474b68
mov dword [ebp - 0xd20], 1
mov dword [ebp - 0xb78], 0xb263d188
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x2e54], eax
cmp dword [ebp - 0xd20], 0x790e8648
jg 0x474ab6
mov dword [ebp - 0x1ab8], 1
jmp 0x474abd
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x1ab8]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x25fc]
neg eax
cmp dword [ebp - 0xb78], eax
jge 0x474b2f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x350c]
sub eax, dword [ebp - 0xd28]
imul eax, dword [ebp - 0xb78]
cmp eax, dword [ebp - 0xd28]
jl 0x474b07
mov dword [ebp - 0x1ac0], 1
jmp 0x474b0e
and dword [ebp - 0x1ac0], 0
cmp dword [ebp - 0x1ac0], 0xd0c1
jle 0x474b23
cmp dword [ebp - 0x2604], 0
je 0x474b2f
mov dword [ebp - 0xd30], 1
jmp 0x474b36
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0x260c], eax
mov byte [ebp - 0x2de], 0
movzx eax, byte [ebp - 0x2de]
test eax, eax
je 0x474b63
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x474a64
mov dword [ebp - 0x1ae0], 0xffffffff
mov dword [ebp - 0x2e5c], 0xffff
mov byte [ebp - 0x2e0], 0
movzx eax, byte [ebp - 0x2e0]
test eax, eax
je 0x474b9b
push 0x551
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [ebp - 0x2e2], 0
movzx eax, byte [ebp - 0x2e2]
test eax, eax
je 0x474bc3
push 0
push 0
push 0x20d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 0x262c], 1
push 2
lea ecx, [ebp - 0x274c]
call fcn.00434460
mov dword [ebp - 0x4f0], 0x9beb0647
push 2
lea ecx, [ebp - 0x29a0]
call fcn.00434460
mov dword [ebp - 0x208], 0
jmp 0x474c0a
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x474c2c
push dword [ebp - 0x208]
lea ecx, [ebp - 0x274c]
call fcn.0043454e
mov dword [eax], 0xbca63185
jmp 0x474bfd
mov dword [ebp - 0x208], 0
jmp 0x474c45
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 2
jge 0x474c67
push dword [ebp - 0x208]
lea ecx, [ebp - 0x29a0]
call fcn.0043454e
mov dword [eax], 0xfffffffa
jmp 0x474c38
mov dword [ebp - 0x4f0], 0
jmp 0x474c80
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 1
jg 0x474e1d
mov dword [ebp - 0xe4], 0x90a624cd
mov dword [ebp - 0xd38], 0xfffd
mov dword [ebp - 0x1ad8], 0xffffffff
mov dword [ebp - 0x261c], 0xaae0
mov dword [ebp - 0xe4], 0
jmp 0x474cce
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jg 0x474cf2
mov esi, dword [ebp - 0xe4]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x274c]
call fcn.0043454e
mov dword [eax], esi
jmp 0x474cc1
cmp dword [ebp - 0xe4], 0
je 0x474e05
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x2e64], eax
cmp dword [ebp - 0xe4], 0
je 0x474d29
cmp dword [ebp - 0xe4], 0
je 0x474d29
mov dword [ebp - 0x1ac8], 1
jmp 0x474d30
and dword [ebp - 0x1ac8], 0
mov esi, dword [ebp - 0xe4]
imul esi, dword [ebp - 0x1ac8]
push 1
lea ecx, [ebp - 0x29a0]
call fcn.0043454e
cmp esi, dword [eax]
jg 0x474d5a
mov dword [ebp - 0x2614], 1
jmp 0x474d61
and dword [ebp - 0x2614], 0
push 1
lea ecx, [ebp - 0x274c]
call fcn.0043454e
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0
je 0x474d98
mov eax, 0xddae974c
test eax, eax
je 0x474d98
mov dword [ebp - 0x1ad0], 1
jmp 0x474d9f
and dword [ebp - 0x1ad0], 0
push 1
lea ecx, [ebp - 0x29a0]
call fcn.0043454e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1ad0]
jg 0x474dd4
push 1
lea ecx, [ebp - 0x274c]
call fcn.0043454e
cmp dword [eax], 0
je 0x474dd4
mov dword [ebp - 0xd40], 1
jmp 0x474ddb
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0x1ad8], eax
cmp dword [ebp - 0x1ad8], 0
je 0x474e05
mov eax, 0xfffb
test eax, eax
je 0x474e05
mov dword [ebp - 0xd48], 1
jmp 0x474e0c
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x261c], eax
jmp 0x474c73
lea ecx, [ebp - 0x29a0]
call fcn.00434532
lea ecx, [ebp - 0x274c]
call fcn.00434532
mov eax, dword [ebp - 0x1ae0]
inc eax
mov dword [ebp - 0x1ae0], eax
push 4
lea ecx, [ebp - 0x2b4c]
call fcn.00434460
mov dword [ebp - 0x120], 0
jmp 0x474e66
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x474e88
push dword [ebp - 0x120]
lea ecx, [ebp - 0x2b4c]
call fcn.0043454e
mov dword [eax], 0xfffffff7
jmp 0x474e59
mov dword [ebp - 0x120], 0
jmp 0x474ea1
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x474ebd
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x2a88], 1
jmp 0x474e94
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2a88], 3
jmp 0x474ee8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2a88]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2a88], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2a88], 0
jl 0x474f38
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x474f18
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2a88]
lea ecx, [ebp - 0x2b4c]
call fcn.0043454e
cmp dword [eax], 0
je 0x474f36
jmp 0x474f38
jmp 0x474ecf
lea ecx, [ebp - 0x2b4c]
call fcn.00434532
mov eax, dword [ebp - 0x2624]
mov dword [ebp - 0x262c], eax
jmp 0x474951
mov dword [ebp - 0x7c], 0xcb50bf34
mov dword [ebp - 0x1ae8], 0xd4a1cf04
mov dword [ebp - 0xd58], 0x6d0c11e0
mov dword [ebp - 0x263c], 0xfffffffe
mov dword [ebp - 0x63c], 0
jmp 0x474f92
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
cmp dword [ebp - 0x63c], 1
jge 0x474fae
mov eax, dword [ebp - 0x63c]
mov dword [ebp + eax*4 - 0x424], 0x8eac8b13
jmp 0x474f85
mov dword [ebp - 0x7c], 0
jmp 0x474fbe
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x475071
mov dword [ebp - 0x2634], 5
mov byte [ebp - 0x29f], 0
movzx eax, byte [ebp - 0x29f]
test eax, eax
je 0x474ffd
push 0
push 0x1711
push 0
push 0xd4
push 0x4f1
call dword [sym.imp.GDI32.dll_ExtCreatePen]
cmp dword [ebp - 0x7c], 0
jne 0x47500c
mov eax, dword [ebp - 0x2634]
cmp dword [ebp - 0x7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x424]
mov dword [ebp - 0x2e6c], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x424]
imul eax, dword [ebp - 0x7c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x424]
jle 0x475048
mov dword [ebp - 0xd50], 1
jmp 0x47504f
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x424]
add eax, dword [ebp - 0xd50]
imul eax, eax, 0xfffffffc
mov ecx, dword [ebp - 0x7c]
mov dword [ebp + ecx*4 - 0x424], eax
jmp 0x474fb7
cmp dword [ebp - 0x7c], 0
jne 0x4750f4
push 9
pop eax
test eax, eax
je 0x4750db
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x424], 1
mov dword [ebp - 0x1ae8], 1
mov eax, dword [ebp - 0x1ae8]
mov dword [ebp - 0xd58], eax
cmp dword [ebp - 0xd58], 1
jl 0x4750ba
mov dword [ebp - 0x1af0], 1
jmp 0x4750c1
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x1af0]
cmp eax, dword [ebp - 0x7c]
jge 0x4750db
mov dword [ebp - 0xd60], 1
jmp 0x4750e2
and dword [ebp - 0xd60], 0
cmp dword [ebp - 0xd60], 0xffffffff
jge 0x4750f4
and dword [ebp - 0x1af8], 0
jmp 0x4750fe
mov dword [ebp - 0x1af8], 1
mov eax, dword [ebp - 0x1af8]
mov dword [ebp - 0x263c], eax
xor ecx, ecx
call fcn.004347cb
push eax
call fcn.0048f893
pop ecx
mov dword [ebp - 0xd68], 5
mov dword [ebp - 0x264c], 0
mov dword [ebp - 0x2e74], 0xde57413
and dword [ebp - 0x2b04], 0
and dword [ebp - 0x2b00], 0
and dword [ebp - 0x2afc], 0
and dword [ebp - 0x2af8], 0
lea ecx, [ebp - 0xaed]
call fcn.0043455d
push eax
lea eax, [ebp - 0x2af4]
push eax
lea eax, [ebp - 0x2b04]
push eax
lea ecx, [ebp - 0x371c]
call fcn.00434560
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x35b0]
call fcn.0043450c
mov dword [ebp - 0xd80], 0
mov dword [ebp - 0x86c], 0
jmp 0x4751aa
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 2
jge 0x4751c6
mov eax, dword [ebp - 0x86c]
mov dword [ebp + eax*4 - 0x9a4], 0
jmp 0x47519d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
mov dword [ebp - 0x2e7c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9a4], 0
jne 0x4751f5
mov dword [ebp - 0x2644], 1
jmp 0x4751fc
and dword [ebp - 0x2644], 0
mov dword [ebp - 0xd68], 0x5f07
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0xd68], eax
jl 0x475227
mov dword [ebp - 0x1b00], 1
jmp 0x47522e
and dword [ebp - 0x1b00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp eax, dword [ebp - 0x1b00]
jge 0x47524f
mov dword [ebp - 0xd70], 1
jmp 0x475256
and dword [ebp - 0xd70], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0xd70], eax
jl 0x475277
mov dword [ebp - 0x1b08], 1
jmp 0x47527e
and dword [ebp - 0x1b08], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
cmp dword [ebp - 0x1b08], eax
jne 0x47529f
mov dword [ebp - 0xd78], 1
jmp 0x4752a6
and dword [ebp - 0xd78], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9a4]
sub eax, dword [ebp - 0xd78]
je 0x4752e0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9a4], 0
je 0x4752e0
mov eax, 0x81438367
test eax, eax
je 0x4752e0
mov dword [ebp - 0x1b10], 1
jmp 0x4752e7
and dword [ebp - 0x1b10], 0
mov eax, dword [ebp - 0x1b10]
mov dword [ebp - 0x264c], eax
mov eax, dword [ebp - 0xd80]
dec eax
mov dword [ebp - 0xd80], eax
lea ecx, [ebp - 0x35b0]
call fcn.00434532
mov dword [ebp - 0x300], 8
mov dword [ebp - 0x265c], 0xa43b2b74
mov dword [ebp - 0x644], 0
mov dword [ebp - 0xb80], 0xffffffff
mov dword [ebp - 0x644], 1
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0x644], eax
jg 0x475357
mov dword [ebp - 0x1b18], 1
jmp 0x47535e
and dword [ebp - 0x1b18], 0
mov eax, dword [ebp - 0xb80]
cmp dword [ebp - 0x1b18], eax
jl 0x475378
mov dword [ebp - 0xd88], 1
jmp 0x47537f
and dword [ebp - 0xd88], 0
mov eax, dword [ebp - 0x300]
cmp dword [ebp - 0xd88], eax
jge 0x475399
mov dword [ebp - 0x2654], 1
jmp 0x4753a0
and dword [ebp - 0x2654], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x2e84], eax
cmp dword [ebp - 0x300], 0
je 0x4753d6
mov byte [ebp - 0x389], 0
movzx eax, byte [ebp - 0x389]
test eax, eax
je 0x4753d1
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x4754cf
mov dword [ebp - 0xb94], 0xba8d7d2a
cmp dword [ebp - 0x265c], 0
je 0x47547e
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x2e8c], eax
cmp dword [ebp - 0xb94], 0x2910
jne 0x47540c
cmp dword [ebp - 0xb80], 0
cmp dword [ebp - 0xb94], 0xffffffff
jg 0x475421
mov dword [ebp - 0x1b20], 1
jmp 0x475428
and dword [ebp - 0x1b20], 0
cmp dword [ebp - 0x1b20], 9
jae 0x47543d
mov dword [ebp - 0xd90], 1
jmp 0x475444
and dword [ebp - 0xd90], 0
cmp dword [ebp - 0xd90], 0
jb 0x475459
mov dword [ebp - 0x1b28], 1
jmp 0x475460
and dword [ebp - 0x1b28], 0
imul eax, dword [ebp - 0x1b28], 0x6a21
cmp eax, dword [ebp - 0xb94]
jle 0x47547e
mov dword [ebp - 0xd98], 1
jmp 0x475485
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0x644], eax
mov dword [ebp - 0x300], 0
jmp 0x4754aa
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xfffffff8
jge 0x4754cf
mov byte [ebp - 0x2a1], 0
movzx eax, byte [ebp - 0x2a1]
test eax, eax
je 0x4754cd
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
jmp 0x47549d
push 1
lea ecx, [ebp - 0x321c]
call fcn.00434460
mov dword [ebp - 0x64c], 0x6de713a
mov dword [ebp - 0x2e94], 0xab65
mov dword [ebp - 0x874], 0
jmp 0x475509
mov eax, dword [ebp - 0x874]
inc eax
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 1
jge 0x47552b
push dword [ebp - 0x874]
lea ecx, [ebp - 0x321c]
call fcn.0043454e
mov dword [eax], 0x55683450
jmp 0x4754fc
mov byte [ebp - 0x3e6], 0
movzx eax, byte [ebp - 0x3e6]
test eax, eax
je 0x475547
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
mov dword [ebp - 0x64c], 0
jmp 0x475560
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0
jg 0x475591
mov byte [ebp - 0x2a3], 0
movzx eax, byte [ebp - 0x2a3]
test eax, eax
je 0x47558f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
jmp 0x475553
lea ecx, [ebp - 0x321c]
call fcn.00434532
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x230], 0xd62a
mov dword [ebp - 0x308], 1
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x1b58], 0x78d11e8e
mov dword [ebp - 0x87c], 0
jmp 0x4755e4
mov eax, dword [ebp - 0x87c]
inc eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 3
jge 0x475600
mov eax, dword [ebp - 0x87c]
mov dword [ebp + eax*4 - 0x2c48], 1
jmp 0x4755d7
cmp dword [ebp - 0x2c], 0
je 0x4756d4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2e9c], eax
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
cmp eax, 0xfe81720d
jne 0x47562d
mov dword [ebp - 0x2664], 1
jmp 0x475634
and dword [ebp - 0x2664], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2ea4], eax
cmp dword [ebp - 0x2c], 0
jne 0x475655
mov eax, 0x98ab79ae
test eax, eax
jne 0x475655
and dword [ebp - 0x266c], 0
jmp 0x47565f
mov dword [ebp - 0x266c], 1
cmp dword [ebp - 0x2c], 0x3072c02a
jg 0x47567a
cmp dword [ebp - 0x230], 0
jne 0x47567a
and dword [ebp - 0x2674], 0
jmp 0x475684
mov dword [ebp - 0x2674], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2eac], eax
cmp dword [ebp - 0x230], 0
je 0x4756a8
cmp dword [ebp - 0x2c], 0
je 0x4756a8
mov dword [ebp - 0x1b30], 1
jmp 0x4756af
and dword [ebp - 0x1b30], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x1b30]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
je 0x4756d4
mov dword [ebp - 0xda0], 1
jmp 0x4756db
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0xda0]
cmp eax, dword [ebp - 0x230]
jl 0x4756f8
mov dword [ebp - 0x1b38], 1
jmp 0x4756ff
and dword [ebp - 0x1b38], 0
cmp dword [ebp - 0x1b38], 1
jae 0x475714
mov dword [ebp - 0xda8], 1
jmp 0x47571b
and dword [ebp - 0xda8], 0
cmp dword [ebp - 0xda8], 0xfffffff8
jne 0x475730
mov dword [ebp - 0x1b40], 1
jmp 0x475737
and dword [ebp - 0x1b40], 0
cmp dword [ebp - 0x1b40], 0x91a83acd
ja 0x475758
cmp dword [ebp - 0x308], 0
je 0x475758
mov dword [ebp - 0xdb0], 1
jmp 0x47575f
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x230], 0
jmp 0x475784
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jg 0x4759b3
mov dword [ebp - 0xdc8], 5
mov dword [ebp - 0x2c], 0
jmp 0x4757ab
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x4759ae
mov dword [ebp - 0x5a8], 0x9c85691f
mov dword [ebp - 0x270], 2
jmp 0x4757d8
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jl 0x4759a9
cmp dword [ebp - 0x230], 0xa25
jle 0x4757fd
mov dword [ebp - 0x1b48], 1
jmp 0x475804
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0xdc8]
add eax, dword [ebp - 0x1b48]
cmp eax, 0x4730
jne 0x475823
mov dword [ebp - 0xdb8], 1
jmp 0x47582a
and dword [ebp - 0xdb8], 0
cmp dword [ebp - 0xdb8], 0
jle 0x475845
cmp dword [ebp - 0x5a8], 0
jne 0x475845
and dword [ebp - 0x1b50], 0
jmp 0x47584f
mov dword [ebp - 0x1b50], 1
cmp dword [ebp - 0x1b50], 0xffffffff
jl 0x475864
mov dword [ebp - 0xdc0], 1
jmp 0x47586b
and dword [ebp - 0xdc0], 0
cmp dword [ebp - 0xdc0], 3
jne 0x475880
mov dword [ebp - 0x267c], 1
jmp 0x475887
and dword [ebp - 0x267c], 0
mov eax, dword [ebp - 0x270]
mov eax, dword [ebp + eax*4 - 0x2c48]
mov dword [ebp - 0x2eb4], eax
mov dword [ebp - 0x1b58], 0x4179
mov eax, dword [ebp - 0x1b58]
mov ecx, dword [ebp - 0x270]
imul eax, dword [ebp + ecx*4 - 0x2c48]
mov ecx, 0xffff
sub ecx, eax
imul ecx, dword [ebp - 0xdc8]
test ecx, ecx
jne 0x4758e3
mov eax, dword [ebp - 0x270]
cmp dword [ebp + eax*4 - 0x2c48], 0
jne 0x4758e3
and dword [ebp - 0x1b60], 0
jmp 0x4758ed
mov dword [ebp - 0x1b60], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1b60], eax
jge 0x475911
mov dword [ebp - 0x2684], 0x4406997b
mov dword [ebp - 0x2684], 0x9efecf47
jmp 0x4759a4
mov dword [ebp - 0x268c], 0xfe29
mov dword [ebp - 0x308], 0
jmp 0x475934
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 2
jg 0x47595b
mov byte [ebp - 0x391], 0
movzx eax, byte [ebp - 0x391]
test eax, eax
je 0x475959
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x475927
mov dword [ebp - 0x5a8], 0
jmp 0x475974
mov eax, dword [ebp - 0x5a8]
inc eax
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 2
jg 0x4759a4
cmp dword [ebp - 0x268c], 0
je 0x475988
jmp 0x4759a4
mov byte [ebp - 0x2a5], 0
movzx eax, byte [ebp - 0x2a5]
test eax, eax
je 0x4759a2
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
jmp 0x475967
jmp 0x4757cb
jmp 0x4757a4
jmp 0x475777
mov dword [ebp - 0x9c], 0xcb50bf34
mov dword [ebp - 0x248], 0x85f70ad6
push 1
lea ecx, [ebp - 0x322c]
call fcn.00434460
mov dword [ebp - 0x2ebc], 0x12c51978
mov dword [ebp - 0x140], 0
jmp 0x4759f7
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x475a13
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x356c], 1
jmp 0x4759ea
mov dword [ebp - 0x140], 0
jmp 0x475a2c
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x475a4e
push dword [ebp - 0x140]
lea ecx, [ebp - 0x322c]
call fcn.0043454e
mov dword [eax], 0x44653ff
jmp 0x475a1f
mov dword [ebp - 0x248], 0xfffffffc
jmp 0x475a67
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 8
jge 0x475c14
mov dword [ebp - 0x1e8], 0xb3152c58
mov dword [ebp - 0x2ec4], 0xadf62858
mov dword [ebp - 0x2694], 5
mov dword [ebp - 0x1e8], 0
jmp 0x475aab
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jg 0x475c0f
mov dword [ebp - 0x654], 0x62ee6d05
mov dword [ebp - 0xbcc], 0x7c70
mov dword [ebp - 0x654], 0
jmp 0x475ae5
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 3
jg 0x475b16
mov byte [ebp - 0x3e8], 0
movzx eax, byte [ebp - 0x3e8]
test eax, eax
je 0x475b14
push 0
push 0x25de
push 0x1762
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x475ad8
mov eax, dword [ebp - 0xbcc]
dec eax
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0xbcc], 3
je 0x475b38
mov dword [ebp - 0xdd8], 1
jmp 0x475b3f
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1e8]
mov ecx, dword [ebp + ecx*4 - 0x356c]
cmp dword [ebp + eax*4 - 0x356c], ecx
je 0x475b67
mov dword [ebp - 0xdd0], 1
jmp 0x475b6e
and dword [ebp - 0xdd0], 0
cmp dword [ebp - 0x1e8], 0x79a2
jge 0x475b86
mov dword [ebp - 0x1b68], 1
jmp 0x475b8d
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0xdd0]
cmp eax, dword [ebp - 0x1b68]
jle 0x475bad
cmp dword [ebp - 0x1e8], 0
jne 0x475bad
and dword [ebp - 0x1b70], 0
jmp 0x475bb7
mov dword [ebp - 0x1b70], 1
mov eax, 0x4a9b
sub eax, dword [ebp - 0xdd8]
cmp eax, dword [ebp - 0x1b70]
jne 0x475bd6
mov dword [ebp - 0xde0], 1
jmp 0x475bdd
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0xde0], eax
je 0x475bf7
mov dword [ebp - 0x1b78], 1
jmp 0x475bfe
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x1b78]
mov dword [ebp - 0x2694], eax
jmp 0x475a9e
jmp 0x475a5a
mov dword [ebp - 0x248], 0
jmp 0x475c2d
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jg 0x475c88
mov dword [ebp - 0x884], 0
jmp 0x475c4f
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 2
jge 0x475c6b
mov eax, dword [ebp - 0x884]
mov dword [ebp + eax*4 - 0x2a50], 0xcc5c6a3f
jmp 0x475c42
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a50]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2a50], eax
jmp 0x475c20
lea ecx, [ebp - 0x322c]
call fcn.00434532
mov dword [ebp - 0x1cf8], 0xd4a1cf04
mov dword [ebp - 0x2964], 0x48d3
mov dword [ebp - 0x2960], 0x48d3
mov dword [ebp - 0x295c], 0x48d3
mov dword [ebp - 0x2958], 0x48d3
mov dword [ebp - 0x310], 1
mov dword [ebp - 0x310], 3
jmp 0x475ce8
mov eax, dword [ebp - 0x310]
dec eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
jl 0x475d1f
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0x310]
mov eax, dword [ebp + eax*4 - 0x2964]
mov dword [ebp + ecx*4 - 0x2964], eax
mov eax, dword [ebp - 0x310]
cmp dword [ebp + eax*4 - 0x2964], 0
je 0x475d1d
jmp 0x475d1f
jmp 0x475cdb
mov byte [ebp - 0x2a7], 0
movzx eax, byte [ebp - 0x2a7]
test eax, eax
je 0x475d3e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0xf68], 0x6d0c11e0
push 2
lea ecx, [ebp - 0x608]
call fcn.00434460
mov dword [ebp - 0x1c], 0
push 4
lea ecx, [ebp - 0x22ec]
call fcn.00434460
mov dword [ebp - 0xe28], 0xffff
mov dword [ebp - 0x9e0], 0x46ed9a83
mov dword [ebp - 0x4c], 0
jmp 0x475d8d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x475da9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov dword [eax], 1
jmp 0x475d86
mov dword [ebp - 0x4c], 0
jmp 0x475db9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x475dd5
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x22ec]
call fcn.0043454e
mov dword [eax], 0x2f20920a
jmp 0x475db2
mov dword [ebp - 0x4c], 0
jmp 0x475de5
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x475dfb
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x26bc], 0xfffffffa
jmp 0x475dde
mov dword [ebp - 0x1c], 0
jmp 0x475e0b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x47638e
mov dword [ebp - 0xdf0], 0
mov dword [ebp - 0x1b98], 0
mov dword [ebp - 0x26a4], 0x8d46758e
mov dword [ebp - 0x4f8], 0x49bc
push 2
lea ecx, [ebp - 0x29b8]
call fcn.00434460
mov dword [ebp - 0x148], 0
jmp 0x475e63
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x475e7f
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x9d8], 1
jmp 0x475e56
mov dword [ebp - 0x148], 0
jmp 0x475e98
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x475eba
push dword [ebp - 0x148]
lea ecx, [ebp - 0x29b8]
call fcn.0043454e
mov dword [eax], 0xc0e3e0ec
jmp 0x475e8b
mov eax, 0x8f69f7fd
test eax, eax
je 0x475fb9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
push 0
lea ecx, [ebp - 0x608]
call fcn.0043454e
cmp dword [eax], 0
jne 0x475ef6
cmp dword [ebp - 0x1c], 0
jne 0x475ef6
and dword [ebp - 0x1b80], 0
jmp 0x475f00
mov dword [ebp - 0x1b80], 1
mov eax, 0xad5a519d
test eax, eax
je 0x475f28
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
cmp dword [eax], 0
je 0x475f28
mov dword [ebp - 0xde8], 1
jmp 0x475f2f
and dword [ebp - 0xde8], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov esi, dword [ebp - 0xde8]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x608]
call fcn.0043454e
sub esi, dword [eax]
cmp esi, dword [ebp - 0x1b98]
jg 0x475f68
mov dword [ebp - 0x269c], 1
jmp 0x475f6f
and dword [ebp - 0x269c], 0
mov eax, dword [ebp - 0x1b80]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0x2ecc], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov esi, dword [ebp - 0x26a4]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
cmp esi, dword [eax]
jge 0x475fb9
mov dword [ebp - 0x1b88], 1
jmp 0x475fc0
and dword [ebp - 0x1b88], 0
push 0
lea ecx, [ebp - 0x22ec]
call fcn.0043454e
mov ecx, dword [ebp - 0x1b88]
mov dword [eax], ecx
push 2
pop eax
test eax, eax
je 0x47611b
cmp dword [ebp - 0x1c], 5
jne 0x475ff2
mov dword [ebp - 0xdf8], 1
jmp 0x475ff9
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0xe28]
cmp dword [ebp - 0xdf8], eax
jne 0x476013
mov dword [ebp - 0x1b90], 1
jmp 0x47601a
and dword [ebp - 0x1b90], 0
cmp dword [ebp - 0x1b90], 1
ja 0x47602f
mov dword [ebp - 0x26ac], 1
jmp 0x476036
and dword [ebp - 0x26ac], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov esi, eax
push 0
lea ecx, [ebp - 0x22ec]
call fcn.0043454e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x476065
mov dword [ebp - 0xe00], 1
jmp 0x47606c
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0xe00]
add eax, 0xbe99
jne 0x47608b
cmp dword [ebp - 0x1b98], 0
jne 0x47608b
and dword [ebp - 0xe08], 0
jmp 0x476095
mov dword [ebp - 0xe08], 1
push 0
lea ecx, [ebp - 0x22ec]
call fcn.0043454e
mov ecx, dword [ebp - 0xe08]
cmp ecx, dword [eax]
jle 0x4760b8
mov dword [ebp - 0xaec], 1
jmp 0x4760bf
and dword [ebp - 0xaec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xaec]
mov dword [ebp + eax - 0x9d8], ecx
cmp dword [ebp - 0xaec], 0x63ad
jge 0x4760ea
mov dword [ebp - 0x26b4], 1
jmp 0x4760f1
and dword [ebp - 0x26b4], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x2ed4], eax
push 0
lea ecx, [ebp - 0x22ec]
call fcn.0043454e
cmp dword [eax], 0xfffffff8
jae 0x47611b
mov dword [ebp - 0x1ba0], 1
jmp 0x476122
and dword [ebp - 0x1ba0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ba0]
mov dword [ebp + eax - 0x26bc], ecx
mov dword [ebp - 0x4f8], 0
jmp 0x47614e
cmp dword [ebp - 0x4f8], 1
jg 0x47637e
mov dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0x22ec]
call fcn.0043454e
mov dword [eax], 7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
cmp dword [eax], 7
jne 0x476197
mov dword [ebp - 0xe10], 1
jmp 0x47619e
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x9e0]
cmp dword [ebp - 0xe10], eax
jle 0x4761b8
mov dword [ebp - 0x26c4], 1
jmp 0x4761bf
and dword [ebp - 0x26c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d8]
mov dword [ebp - 0x2edc], eax
cmp dword [ebp - 0x570], 0
jne 0x4761ed
cmp dword [ebp - 0x570], 0
jne 0x4761ed
and dword [ebp - 0x1ba8], 0
jmp 0x4761f7
mov dword [ebp - 0x1ba8], 1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov ecx, dword [ebp - 0x1ba8]
sub ecx, dword [eax]
jne 0x47621c
xor eax, eax
jne 0x47621c
and dword [ebp - 0xe18], 0
jmp 0x476226
mov dword [ebp - 0xe18], 1
mov eax, dword [ebp - 0x570]
mov ecx, dword [ebp - 0xe18]
lea eax, [ecx + eax - 0xc0c2]
neg eax
je 0x476250
push 5
pop eax
test eax, eax
je 0x476250
mov dword [ebp - 0x1bb0], 1
jmp 0x476257
and dword [ebp - 0x1bb0], 0
mov eax, dword [ebp - 0x570]
cmp dword [ebp - 0x1bb0], eax
jg 0x476271
mov dword [ebp - 0xe20], 1
jmp 0x476278
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0x570]
cmp eax, dword [ebp - 0xe20]
jg 0x476292
mov dword [ebp - 0x1bb8], 1
jmp 0x476299
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0x1bb8]
add eax, dword [ebp - 0xe28]
mov dword [ebp - 0x1bc0], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov ecx, dword [ebp - 0x1bc0]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d8]
imul eax, dword [ebp - 0x1bc0]
cmp eax, dword [ebp - 0x9e0]
jne 0x4762f9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x608]
call fcn.0043454e
cmp dword [eax], 0
jne 0x4762f9
and dword [ebp - 0xbd0], 0
jmp 0x476303
mov dword [ebp - 0xbd0], 1
push 0
lea ecx, [ebp - 0x29b8]
call fcn.0043454e
mov ecx, dword [ebp - 0xbd0]
mov dword [eax], ecx
cmp dword [ebp - 0xbd0], 0
je 0x47633f
push 1
lea ecx, [ebp - 0x29b8]
call fcn.0043454e
cmp dword [eax], 0
je 0x47633f
mov dword [ebp - 0xe30], 1
jmp 0x476346
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xe30], eax
jg 0x47635d
mov dword [ebp - 0x26cc], 1
jmp 0x476364
and dword [ebp - 0x26cc], 0
push 0
lea ecx, [ebp - 0x608]
call fcn.0043454e
mov eax, dword [eax]
mov dword [ebp - 0x9e0], eax
jmp 0x476141
lea ecx, [ebp - 0x29b8]
call fcn.00434532
jmp 0x475e04
lea ecx, [ebp - 0x22ec]
call fcn.00434532
lea ecx, [ebp - 0x608]
call fcn.00434532
mov dword [ebp - 0x24f0], 0xfffffffe
push 2
lea ecx, [ebp - 0x275c]
call fcn.00434460
mov dword [ebp - 0xcc], 0x73838a1f
mov dword [ebp - 0x65c], 0
jmp 0x4763de
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 2
jge 0x476400
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x275c]
call fcn.0043454e
mov dword [eax], 1
jmp 0x4763d1
mov dword [ebp - 0xcc], 0
jmp 0x476419
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x47643b
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x275c]
call fcn.0043454e
mov dword [eax], 0x964a53aa
jmp 0x47640c
mov dword [ebp - 0xcc], 0xfffffff6
jmp 0x476454
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffe6
jl 0x4765e1
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x318], 0
jmp 0x476484
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xffffffea
jg 0x4765dc
mov dword [ebp - 0x88c], 6
cmp dword [ebp - 0x88c], 0x817b04fa
jl 0x4764bc
cmp dword [ebp - 0x318], 0
je 0x4764bc
mov dword [ebp - 0x1bc8], 1
jmp 0x4764c3
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x1bc8]
jne 0x4764dd
mov dword [ebp - 0xe38], 1
jmp 0x4764e4
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x88c]
cmp dword [ebp - 0xe38], eax
jne 0x4764fe
mov dword [ebp - 0x1bd0], 1
jmp 0x476505
and dword [ebp - 0x1bd0], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x1bd0], eax
jg 0x47651f
mov dword [ebp - 0xe40], 1
jmp 0x476526
and dword [ebp - 0xe40], 0
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0xe40]
jg 0x476540
mov dword [ebp - 0x1bd8], 1
jmp 0x476547
and dword [ebp - 0x1bd8], 0
cmp dword [ebp - 0x1bd8], 0xffffffff
jge 0x47655c
mov dword [ebp - 0xe48], 1
jmp 0x476563
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0xe48]
jle 0x47657d
mov dword [ebp - 0x1be0], 1
jmp 0x476584
and dword [ebp - 0x1be0], 0
cmp dword [ebp - 0x1be0], 0x38d06721
jle 0x4765a2
cmp dword [ebp - 0x88c], 0
jne 0x4765a2
and dword [ebp - 0xe50], 0
jmp 0x4765ac
mov dword [ebp - 0xe50], 1
push 1
lea ecx, [ebp - 0x275c]
call fcn.0043454e
mov esi, dword [ebp - 0xe50]
sub esi, dword [eax]
imul esi, dword [ebp - 0x88c]
push 1
lea ecx, [ebp - 0x275c]
call fcn.0043454e
mov dword [eax], esi
jmp 0x476477
jmp 0x476447
lea ecx, [ebp - 0x275c]
call fcn.00434532
mov dword [ebp - 0x664], 0
jmp 0x476605
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 1
jge 0x476621
mov eax, dword [ebp - 0x664]
mov dword [ebp + eax*4 - 0x474], 0x8eac8b13
jmp 0x4765f8
mov dword [ebp - 0x894], 0x4a8b
mov dword [ebp - 0x1be8], 0
mov dword [ebp - 0xe58], 0xffffffff
mov dword [ebp - 0xaf4], 0xfffffff8
mov dword [ebp - 0x26d4], 0
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x1be8], eax
mov eax, dword [ebp - 0x1be8]
cmp dword [ebp - 0x894], eax
jg 0x476679
mov dword [ebp - 0x1bf0], 1
jmp 0x476680
and dword [ebp - 0x1bf0], 0
cmp dword [ebp - 0x894], 0
je 0x4766a9
xor eax, eax
jne 0x4766c4
mov eax, dword [ebp - 0xe58]
imul eax, dword [ebp - 0xe58]
mov dword [ebp - 0xaf4], eax
cmp dword [ebp - 0xaf4], 0
jne 0x4766c4
cmp dword [ebp - 0x894], 0
jne 0x4766c4
cmp dword [ebp - 0xaf4], 0
jne 0x4766c4
and dword [ebp - 0xe60], 0
jmp 0x4766ce
mov dword [ebp - 0xe60], 1
mov eax, dword [ebp - 0x1bf0]
cmp eax, dword [ebp - 0xe60]
jl 0x4766e8
mov dword [ebp - 0x1bf8], 1
jmp 0x4766ef
and dword [ebp - 0x1bf8], 0
mov eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0x26d4], eax
mov byte [ebp - 0x399], 0
movzx eax, byte [ebp - 0x399]
test eax, eax
je 0x476719
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x9c], 0
jmp 0x476732
cmp dword [ebp - 0x9c], 0
jg 0x47795f
mov dword [ebp - 0xa4], 6
mov dword [ebp - 0x320], 0xbf698ba8
mov dword [ebp - 0xa4], 0xfffffff6
jmp 0x47676c
cmp dword [ebp - 0xa4], 0xffffffee
jle 0x476d02
mov dword [ebp - 0x8c], 0x36951ad3
mov dword [ebp - 0x26dc], 2
mov dword [ebp - 0x674], 0x68c2afe2
push 3
lea ecx, [ebp - 0x223c]
call fcn.00434460
mov dword [ebp - 0x66c], 0
jmp 0x4767bd
cmp dword [ebp - 0x66c], 3
jge 0x4767dc
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x2920], 5
mov dword [ebp - 0x150], 0xffffffff
push 2
lea ecx, [ebp - 0x323c]
call fcn.00434460
mov dword [ebp - 0xee8], 0xe734e2e0
mov dword [ebp - 0x228], 0
jmp 0x476d52
cmp dword [ebp - 0x228], 1
jge 0x476d6e
mov dword [ebp - 0x1cd8], 0xfff7
mov dword [ebp - 0x684], 0xffffffff
mov dword [ebp - 0x8b4], 0x2391cb4e
mov dword [ebp - 0xafc], 4
mov dword [ebp - 0x68c], 0xfffffffd
mov dword [ebp - 0x2f14], 0x4a73
mov dword [ebp - 0x2f1c], 0x38e21363
mov dword [ebp - 0x2f24], 0xffffffff
push 2
lea ecx, [ebp - 0x326c]
call fcn.00434460
mov dword [ebp - 0xf60], 0x18b2
mov dword [ebp - 0x210], 0
jmp 0x4779df
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x4779fb
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x255c], 0x64ba8b35
jmp 0x4779d2
mov dword [ebp - 0x210], 0
jmp 0x477a14
cmp dword [ebp - 0x210], 2
jge 0x477a36