Function at 0x47533f
Capabilities:
Allocate thread local storage
Compare security identifiers
Connect pipe
Create process on windows
Get file attributes
Get keyboard layout
Get memory capacity
Get thread local storage value
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd1c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3278
call fcn.004ac930
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0xec], 0xaf072071
mov dword [ebp - 0x88], 0x6a1c17c7
mov dword [ebp - 0x27c], 0xe661fbc9
mov dword [ebp - 0x1f28], 0
mov dword [ebp - 0x4ac], 0
jmp 0x4753b0
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 2
jge 0x4753cc
mov eax, dword [ebp - 0x4ac]
mov dword [ebp + eax*4 - 0x2874], 0xca54
jmp 0x4753a3
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x2c]
je 0x47548b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x2c], eax
jge 0x4753f8
mov dword [ebp - 0xee8], 1
jmp 0x4753ff
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x475413
mov dword [ebp - 0x1dc8], 1
jmp 0x47541a
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0xee8]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2ef8], eax
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0xec], eax
jge 0x47544c
mov dword [ebp - 0x1b48], 1
jmp 0x475453
and dword [ebp - 0x1b48], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1b48], eax
jle 0x47546a
mov dword [ebp - 0x1b50], 1
jmp 0x475471
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x1b50]
test eax, eax
je 0x47548b
mov dword [ebp - 0x1b58], 1
jmp 0x475492
and dword [ebp - 0x1b58], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1b58], eax
jg 0x4754a9
mov dword [ebp - 0x1b60], 1
jmp 0x4754b0
and dword [ebp - 0x1b60], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x1b60], eax
jge 0x4754ca
mov dword [ebp - 0x1b68], 1
jmp 0x4754d1
and dword [ebp - 0x1b68], 0
mov eax, dword [ebp - 0x1b68]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
je 0x4759bb
mov dword [ebp - 0x218], 0xfffffff8
push 4
lea ecx, [ebp - 0x968]
call fcn.00433ba3
mov dword [ebp - 0x65c], 0
jmp 0x47551a
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 4
jge 0x47553c
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x968]
call fcn.00433c91
mov dword [eax], 0x457023
jmp 0x47550d
mov eax, 0xbac89d73
test eax, eax
je 0x475563
push 0
lea ecx, [ebp - 0x968]
call fcn.00433c91
cmp dword [eax], 0
je 0x475563
mov dword [ebp - 0x1f18], 1
jmp 0x47556a
and dword [ebp - 0x1f18], 0
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x2e98], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2c00], eax
cmp dword [ebp - 0x2c], 0xffffffff
jle 0x47559e
mov dword [ebp - 0x1b70], 1
jmp 0x4755a5
and dword [ebp - 0x1b70], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x1b70], eax
je 0x4755bf
mov dword [ebp - 0x1b78], 1
jmp 0x4755c6
and dword [ebp - 0x1b78], 0
mov eax, dword [ebp - 0x1b78]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
push 3
lea ecx, [ebp - 0x968]
call fcn.00433c91
cmp dword [eax], esi
jg 0x475601
mov dword [ebp - 0x1f20], 1
jmp 0x475608
and dword [ebp - 0x1f20], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x309c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x88], eax
jg 0x47562b
mov dword [ebp - 0x1b80], 1
jmp 0x475632
and dword [ebp - 0x1b80], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x1b80], eax
jge 0x47564c
mov dword [ebp - 0x1b88], 1
jmp 0x475653
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x1b88]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
je 0x475871
mov dword [ebp - 0x4b4], 0x179b2c39
mov dword [ebp - 0x1f30], 0xef5427e5
cmp dword [ebp - 0x1f28], 0
jne 0x475722
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2874]
cmp dword [ebp - 0x4b4], eax
jle 0x4756ae
mov dword [ebp - 0x1b90], 1
jmp 0x4756b5
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x1b90], eax
je 0x4756cf
mov dword [ebp - 0x1b98], 1
jmp 0x4756d6
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x1b98]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
add eax, 0x30e92f9e
je 0x4756f6
cmp dword [ebp - 0xec], 0
push 0
lea ecx, [ebp - 0x968]
call fcn.00433c91
push 0
lea ecx, [ebp - 0x968]
call fcn.00433c91
cmp dword [eax], 0
jne 0x475722
push 0
lea ecx, [ebp - 0x968]
call fcn.00433c91
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x4b4], eax
je 0x47573c
mov dword [ebp - 0x1ba0], 1
jmp 0x475743
and dword [ebp - 0x1ba0], 0
push 1
lea ecx, [ebp - 0x968]
call fcn.00433c91
mov ecx, dword [ebp - 0x1ba0]
cmp ecx, dword [eax]
jle 0x475775
push 3
lea ecx, [ebp - 0x968]
call fcn.00433c91
cmp dword [eax], 0
jne 0x475775
and dword [ebp - 0x1ba8], 0
jmp 0x47577f
mov dword [ebp - 0x1ba8], 1
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x1ba8], eax
jge 0x475799
mov dword [ebp - 0x1bb0], 1
jmp 0x4757a0
and dword [ebp - 0x1bb0], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x1bb0], eax
jg 0x4757ba
mov dword [ebp - 0x1bb8], 1
jmp 0x4757c1
and dword [ebp - 0x1bb8], 0
mov esi, dword [ebp - 0x88]
push 0
lea ecx, [ebp - 0x968]
call fcn.00433c91
imul esi, dword [eax]
cmp esi, dword [ebp - 0x1bb8]
jle 0x4757eb
mov dword [ebp - 0x1bc0], 1
jmp 0x4757f2
and dword [ebp - 0x1bc0], 0
mov eax, dword [ebp - 0x1bc0]
mov dword [ebp - 0x1f30], eax
mov dword [ebp - 0x2c], 0
jmp 0x47580e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x47586c
mov dword [ebp - 0x88], 1
jmp 0x47582d
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x47586a
mov byte [ebp - 0x36c], 0
movzx eax, byte [ebp - 0x36c]
test eax, eax
je 0x475868
push 0
push 0x405
push 0x1d55
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x475820
jmp 0x475807
jmp 0x4759ae
mov dword [ebp - 0x948], 0x2166a3c8
mov dword [ebp - 0x1bd0], 0xfffffffb
mov dword [ebp - 0x1f40], 0
mov dword [ebp - 0x2c], 0
jmp 0x47589f
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffec
jl 0x4759ae
mov dword [ebp - 0x1be0], 0x6118
mov dword [ebp - 0x7c8], 0xfffffffc
cmp dword [ebp - 0x1be0], 0x95192c24
jae 0x4758d5
mov dword [ebp - 0x1bc8], 1
jmp 0x4758dc
and dword [ebp - 0x1bc8], 0
mov eax, dword [ebp - 0x88]
neg eax
cmp dword [ebp - 0x1bc8], eax
jle 0x4758f8
mov dword [ebp - 0x1f38], 1
jmp 0x4758ff
and dword [ebp - 0x1f38], 0
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x2c08], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1bd0], eax
mov eax, dword [ebp - 0x1bd0]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jle 0x47593e
cmp dword [ebp - 0x7c8], 0
jne 0x47593e
and dword [ebp - 0x1bd8], 0
jmp 0x475948
mov dword [ebp - 0x1bd8], 1
mov eax, dword [ebp - 0x1bd8]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x2ea8], eax
mov eax, dword [ebp - 0x1f40]
mov dword [ebp - 0x2c10], eax
mov eax, dword [ebp - 0x1be0]
mov dword [ebp - 0x2fe8], eax
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x2c18], eax
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x948], eax
push 0
lea ecx, [ebp - 0x968]
call fcn.00433c91
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x948], eax
jmp 0x475898
lea ecx, [ebp - 0x968]
call fcn.00433c75
jmp 0x4759dc
mov byte [ebp - 0x36e], 0
movzx eax, byte [ebp - 0x36e]
test eax, eax
je 0x4759dc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x1be8], 0x99c
mov dword [ebp - 0x1bf0], 0xffffffff
mov dword [ebp - 0x1c08], 0x1f07b4bc
mov dword [ebp - 0x27e8], 0
mov dword [ebp - 0x27e4], 0
mov dword [ebp - 0x27e0], 0
mov dword [ebp - 0x27dc], 0
mov byte [ebp - 0x2bd], 0
movzx eax, byte [ebp - 0x2bd]
test eax, eax
je 0x475a3a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x1be8]
cmp dword [ebp - 0x1be8], eax
jge 0x475a54
mov dword [ebp - 0x1bf8], 1
jmp 0x475a5b
and dword [ebp - 0x1bf8], 0
mov dword [ebp - 0x1bf0], 0xfffffffc
mov eax, dword [ebp - 0x1bf0]
cmp dword [ebp - 0x1bf8], eax
jne 0x475a7f
mov dword [ebp - 0x1c00], 1
jmp 0x475a86
and dword [ebp - 0x1c00], 0
mov eax, dword [ebp - 0x1c00]
mov dword [ebp - 0x1c08], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1c08]
mov dword [ebp + eax - 0x27e8], ecx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x4bc], 0x17571177
mov dword [ebp - 0x1f50], 1
mov dword [ebp - 0x2eb8], 0xfffffff9
mov dword [ebp - 0x2c20], 0xd2e819d3
mov dword [ebp - 0x30b8], 0x53005475
mov dword [ebp - 0x2c28], 9
mov dword [ebp - 0x1c28], 0xffffffff
mov dword [ebp - 0x2ec8], 0x7e595016
mov dword [ebp - 0x2c30], 0xffffffff
mov dword [ebp - 0x2ff0], 0x5cb51404
mov dword [ebp - 0x2c38], 0xdaafd55b
push 4
lea ecx, [ebp - 0x2d54]
call fcn.00433ba3
mov dword [ebp - 0x2ed8], 4
mov dword [ebp - 0x2c40], 1
mov dword [ebp - 0x30b0], 0x6c1d66bd
mov dword [ebp - 0x2c48], 0xffffffff
mov dword [ebp - 0x2ee8], 0xb872a60d
mov dword [ebp - 0x2c50], 0x85ca7dbc
push 4
lea ecx, [ebp - 0x2d44]
call fcn.00433ba3
push 3
lea ecx, [ebp - 0x2d34]
call fcn.00433ba3
mov dword [ebp - 0x34], 0
jmp 0x475b8d
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x475ba3
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1f48], 0x45f1dbec
jmp 0x475b86
mov dword [ebp - 0x34], 0
jmp 0x475bb3
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x475bcc
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2d54]
call fcn.00433c91
or dword [eax], 0xffffffff
jmp 0x475bac
mov dword [ebp - 0x34], 0
jmp 0x475bdc
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x475bf8
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2d44]
call fcn.00433c91
mov dword [eax], 0x911ccfe9
jmp 0x475bd5
mov dword [ebp - 0x34], 0
jmp 0x475c08
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x475c24
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2d34]
call fcn.00433c91
mov dword [eax], 1
jmp 0x475c01
mov dword [ebp - 0x4bc], 0xfffffff2
jmp 0x475c3d
mov eax, dword [ebp - 0x4bc]
dec eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0xffffffe8
je 0x475e4c
mov dword [ebp - 0x378], 5
mov dword [ebp - 0x2ff8], 0x68a07c69
mov dword [ebp - 0x293c], 0x68593f9b
mov dword [ebp - 0x2944], 0xa56c37fc
mov dword [ebp - 0x294c], 0xc71cb27f
mov dword [ebp - 0x1c20], 0x8af066b7
mov dword [ebp - 0x2954], 0xffffffff
mov dword [ebp - 0x295c], 0xffffffff
mov dword [ebp - 0x2964], 0x8877e069
mov dword [ebp - 0x296c], 0x616d21b1
mov dword [ebp - 0x2138], 0x45e4
mov dword [ebp - 0x658], 0
jmp 0x475cd1
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 1
jge 0x475ced
mov eax, dword [ebp - 0x658]
mov dword [ebp + eax*4 - 0x2140], 0x25004286
jmp 0x475cc4
mov dword [ebp - 0x378], 0
jmp 0x475d06
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0
jl 0x475e47
mov dword [ebp - 0x950], 0xfffffff8
push 3
lea ecx, [ebp - 0x2688]
call fcn.00433ba3
mov dword [ebp - 0x958], 0x4799
mov dword [ebp - 0x4c4], 0
jmp 0x475d4d
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 3
jge 0x475d6f
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x2688]
call fcn.00433c91
mov dword [eax], 0x88e00f68
jmp 0x475d40
mov eax, dword [ebp - 0x950]
mov ecx, dword [ebp - 0x950]
dec ecx
mov dword [ebp - 0x950], ecx
test eax, eax
je 0x475da2
mov eax, dword [ebp - 0x378]
cmp dword [ebp + eax*4 - 0x1f48], 0
je 0x475da2
mov dword [ebp - 0x1c10], 1
jmp 0x475da9
and dword [ebp - 0x1c10], 0
push 0
lea ecx, [ebp - 0x2688]
call fcn.00433c91
mov ecx, dword [ebp - 0x1c10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x2974], eax
mov eax, dword [ebp - 0x1f50]
mov dword [ebp - 0x297c], eax
mov eax, dword [ebp - 0x958]
inc eax
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x2138], eax
mov eax, 0xffff
cmp eax, 0xffffffff
jne 0x475e05
mov dword [ebp - 0x1c18], 1
jmp 0x475e0c
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x1c18]
mov dword [ebp - 0x1c20], eax
mov eax, dword [ebp - 0x1c20]
mov dword [ebp - 0x1c28], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c28]
mov dword [ebp + eax - 0x2140], ecx
lea ecx, [ebp - 0x2688]
call fcn.00433c75
jmp 0x475cf9
jmp 0x475c30
lea ecx, [ebp - 0x2d34]
call fcn.00433c75
lea ecx, [ebp - 0x2d44]
call fcn.00433c75
lea ecx, [ebp - 0x2d54]
call fcn.00433c75
mov dword [ebp - 0x12c], 0xaf072071
mov dword [ebp - 0x80], 0x6a1c17c7
mov dword [ebp - 0x28c], 0xe661fbc9
mov dword [ebp - 0x3e8], 0xc5021c3a
mov dword [ebp - 0x114], 0x34bd
mov dword [ebp - 0x828], 0xfffffff7
mov dword [ebp - 0x239c], 0xfffffff6
mov dword [ebp - 0x2398], 0xfffffff6
mov dword [ebp - 0x2394], 0xfffffff6
mov dword [ebp - 0x2390], 0xfffffff6
push 3
lea ecx, [ebp - 0x25d4]
call fcn.00433ba3
mov dword [ebp - 0xaac], 0xd552b890
mov dword [ebp - 0x830], 0x1837
mov dword [ebp - 0x2150], 0xd2926a09
mov dword [ebp - 0x13c], 0
jmp 0x475f12
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x475f2e
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xab4], 0x94e8fe75
jmp 0x475f05
mov dword [ebp - 0x13c], 0
jmp 0x475f47
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x475f69
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x25d4]
call fcn.00433c91
mov dword [eax], 3
jmp 0x475f3a
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x2984], eax
cmp dword [ebp - 0x3e8], 0x534de6f8
je 0x475f8d
mov dword [ebp - 0x908], 1
jmp 0x475f94
and dword [ebp - 0x908], 0
cmp dword [ebp - 0x114], 0
je 0x475fae
or eax, 0xffffffff
je 0x475fae
mov dword [ebp - 0x1c30], 1
jmp 0x475fb5
and dword [ebp - 0x1c30], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1c30], eax
jne 0x475fcf
mov dword [ebp - 0x1c38], 1
jmp 0x475fd6
and dword [ebp - 0x1c38], 0
cmp dword [ebp - 0x1c38], 0x86ca
jg 0x475fee
mov dword [ebp - 0x1c40], 1
jmp 0x475ff5
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x1c40]
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x298c], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2994], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x299c], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x29a4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x239c]
mov dword [ebp - 0x29ac], eax
mov eax, dword [ebp - 0x828]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x239c]
add eax, 4
cmp eax, dword [ebp - 0x114]
jl 0x47606e
mov dword [ebp - 0x1c48], 1
jmp 0x476075
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x1c48]
sub eax, 0x5d07a051
cmp eax, dword [ebp - 0x114]
jne 0x476094
mov dword [ebp - 0xa94], 1
jmp 0x47609b
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0x3e8]
add eax, dword [ebp - 0xa94]
je 0x4760be
cmp dword [ebp - 0x114], 0
je 0x4760be
mov dword [ebp - 0x1958], 1
jmp 0x4760c5
and dword [ebp - 0x1958], 0
cmp dword [ebp - 0x1958], 0
jne 0x4760e9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x239c], 0
je 0x4760e9
mov dword [ebp - 0xa9c], 1
jmp 0x4760f0
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xa9c], eax
jne 0x47610a
mov dword [ebp - 0x1960], 1
jmp 0x476111
and dword [ebp - 0x1960], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x908]
mov dword [ebp + eax - 0xab4], ecx
mov eax, dword [ebp - 0x908]
sub eax, dword [ebp - 0x114]
imul ecx, dword [ebp - 0x1960], 0x8d46
cmp eax, ecx
jg 0x47614a
mov dword [ebp - 0xaa4], 1
jmp 0x476151
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xaa4]
neg eax
mov dword [ebp - 0x1968], eax
push 1
lea ecx, [ebp - 0x25d4]
call fcn.00433c91
mov ecx, dword [ebp - 0x1968]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1968]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x3e8]
cmp dword [ebp - 0xaac], eax
jge 0x47619a
mov dword [ebp - 0x1970], 1
jmp 0x4761a1
and dword [ebp - 0x1970], 0
cmp dword [ebp - 0x1970], 0xffff
je 0x4761b9
mov dword [ebp - 0x2148], 1
jmp 0x4761c0
and dword [ebp - 0x2148], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x239c]
mov dword [ebp - 0x29b4], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x830]
cmp eax, dword [ebp - 0x830]
jle 0x476200
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xab4], 0
je 0x476200
mov dword [ebp - 0x1978], 1
jmp 0x476207
and dword [ebp - 0x1978], 0
mov eax, dword [ebp - 0x830]
imul eax, dword [ebp - 0x1978]
test eax, eax
jne 0x47622a
cmp dword [ebp - 0x114], 0
jne 0x47622a
and dword [ebp - 0xabc], 0
jmp 0x476234
mov dword [ebp - 0xabc], 1
mov eax, dword [ebp - 0x3e8]
cmp dword [ebp - 0xabc], eax
jne 0x47624e
mov dword [ebp - 0x1980], 1
jmp 0x476255
and dword [ebp - 0x1980], 0
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x2150], eax
lea ecx, [ebp - 0x25d4]
call fcn.00433c75
mov dword [ebp - 0x2280], 0
mov dword [ebp - 0xf4], 0xb57fd546
mov dword [ebp - 0x4d4], 0xabc106ec
mov dword [ebp - 0x840], 1
mov dword [ebp - 0x928], 0x1ad7ba96
mov dword [ebp - 0x19c8], 0x2d14b432
mov dword [ebp - 0x914], 5
mov dword [ebp - 0xb14], 0
push 2
lea ecx, [ebp - 0x9ec]
call fcn.00433ba3
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x718], 0
jmp 0x4762ec
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 2
jge 0x47630e
push dword [ebp - 0x718]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
mov dword [eax], 4
jmp 0x4762df
mov dword [ebp - 0xf4], 0x15
jmp 0x476327
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 7
jl 0x47676f
push 1
lea ecx, [ebp - 0x1ca8]
call fcn.00433ba3
mov dword [ebp - 0x2178], 0xffffffff
mov dword [ebp - 0x2170], 0x425f5f99
mov dword [ebp - 0x2160], 0x24770669
mov dword [ebp - 0x19a0], 0
mov dword [ebp - 0xad4], 0x50dfa014
mov dword [ebp - 0x838], 0x3446b7d8
mov dword [ebp - 0x2180], 0x248c3319
mov dword [ebp - 0x4cc], 0
jmp 0x4763a0
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 1
jge 0x4763c2
push dword [ebp - 0x4cc]
lea ecx, [ebp - 0x1ca8]
call fcn.00433c91
mov dword [eax], 0xbd7b1c2a
jmp 0x476393
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.00433c91
and dword [eax], 0
jmp 0x4763f8
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.00433c91
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xac4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xac4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.00433c91
cmp dword [eax], 0xfffffff0
jne 0x47653e
mov dword [ebp - 0x29bc], 1
mov dword [ebp - 0x1988], 0x12af04
mov dword [ebp - 0x920], 0
mov dword [ebp - 0x660], 0
jmp 0x476445
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 2
jge 0x476461
mov eax, dword [ebp - 0x660]
mov dword [ebp + eax*4 - 0x287c], 0x5eec80f2
jmp 0x476438
mov byte [ebp - 0x360], 0
movzx eax, byte [ebp - 0x360]
test eax, eax
je 0x47648e
push 0x1e73
push 0
push 0x23de
push 0
push 0x3cb
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [ebp - 0x920]
mov ecx, dword [ebp - 0x920]
dec ecx
mov dword [ebp - 0x920], ecx
test eax, eax
jne 0x4764ae
cmp dword [ebp - 0xf4], 0
je 0x4764c3
mov eax, 0x2047
test eax, eax
je 0x4764c3
mov dword [ebp - 0x2158], 1
jmp 0x4764ca
and dword [ebp - 0x2158], 0
mov eax, dword [ebp - 0x1988]
mov dword [ebp - 0x29c4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x29cc], eax
cmp dword [ebp - 0x1988], 0
je 0x476500
mov eax, 0xa955
test eax, eax
je 0x476500
mov dword [ebp - 0xacc], 1
jmp 0x476507
and dword [ebp - 0xacc], 0
cmp dword [ebp - 0xacc], 0xfffc
jb 0x47651f
mov dword [ebp - 0x1990], 1
jmp 0x476526
and dword [ebp - 0x1990], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1990]
mov dword [ebp + eax - 0x287c], ecx
jmp 0x4763d4
mov dword [ebp - 0xad4], 0xffffffff
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0x29d4], eax
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x29dc], eax
mov eax, dword [ebp - 0x2160]
cmp dword [ebp - 0xf4], eax
jge 0x47658d
mov dword [ebp - 0x2168], 1
jmp 0x476594
and dword [ebp - 0x2168], 0
cmp dword [ebp - 0x19c8], 0
je 0x4765b2
cmp dword [ebp - 0x4d4], 0
je 0x4765b2
mov dword [ebp - 0x1998], 1
jmp 0x4765b9
and dword [ebp - 0x1998], 0
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x1998]
sub eax, dword [ebp - 0xb14]
cmp dword [ebp - 0x838], eax
jl 0x4765e6
mov dword [ebp - 0xadc], 1
jmp 0x4765ed
and dword [ebp - 0xadc], 0
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x19a0], eax
imul eax, dword [ebp - 0x19a0], 0x539
cmp eax, dword [ebp - 0xf4]
jg 0x476617
mov dword [ebp - 0xae4], 1
jmp 0x47661e
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0xae4]
sub eax, 0xff7a
cmp eax, dword [ebp - 0x2170]
jle 0x47663d
mov dword [ebp - 0x19a8], 1
jmp 0x476644
and dword [ebp - 0x19a8], 0
mov eax, dword [ebp - 0x2178]
cmp eax, dword [ebp - 0x19a8]
jne 0x47665e
mov dword [ebp - 0xaec], 1
jmp 0x476665
and dword [ebp - 0xaec], 0
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.00433c91
mov ecx, dword [ebp - 0xaec]
cmp ecx, dword [eax]
jl 0x476688
mov dword [ebp - 0x19b0], 1
jmp 0x47668f
and dword [ebp - 0x19b0], 0
mov eax, dword [ebp - 0x2180]
cmp dword [ebp - 0x19b0], eax
jg 0x4766a9
mov dword [ebp - 0xaf4], 1
jmp 0x4766b0
and dword [ebp - 0xaf4], 0
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x2188], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0x2190], eax
mov eax, dword [ebp - 0x928]
inc eax
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x2188]
cmp eax, dword [ebp - 0x2190]
jl 0x4766ef
mov dword [ebp - 0x19b8], 1
jmp 0x4766f6
and dword [ebp - 0x19b8], 0
push 0
lea ecx, [ebp - 0x1ca8]
call fcn.00433c91
mov ecx, dword [ebp - 0x19b8]
cmp ecx, dword [eax]
jne 0x47671f
cmp dword [ebp - 0xf4], 0
jne 0x47671f
and dword [ebp - 0xafc], 0
jmp 0x476729
mov dword [ebp - 0xafc], 1
push 0
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
mov ecx, dword [ebp - 0xafc]
cmp ecx, dword [eax]
jne 0x47674c
mov dword [ebp - 0x19c0], 1
jmp 0x476753
and dword [ebp - 0x19c0], 0
mov eax, dword [ebp - 0x19c0]
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0x1ca8]
call fcn.00433c75
jmp 0x47631a
mov dword [ebp - 0xd8], 0
jmp 0x476788
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jg 0x47699c
mov dword [ebp - 0x21a0], 0xfffffff6
mov dword [ebp - 0x21a8], 1
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
cmp dword [eax], 0x672fee61
jge 0x47688e
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
cmp dword [eax], 1
jne 0x4767e8
mov dword [ebp - 0xb04], 1
jmp 0x4767ef
and dword [ebp - 0xb04], 0
cmp dword [ebp - 0xb04], 1
jge 0x47680a
cmp dword [ebp - 0x19c8], 0
jne 0x47680a
and dword [ebp - 0xb0c], 0
jmp 0x476814
mov dword [ebp - 0xb0c], 1
mov eax, dword [ebp - 0x840]
cmp dword [ebp - 0xb0c], eax
jl 0x47682e
mov dword [ebp - 0x19d0], 1
jmp 0x476835
and dword [ebp - 0x19d0], 0
mov eax, dword [ebp - 0x19d0]
add eax, 0xffff
cmp eax, 0x1fe4
je 0x476853
mov dword [ebp - 0x2198], 1
jmp 0x47685a
and dword [ebp - 0x2198], 0
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
mov eax, 0xffff
test eax, eax
jne 0x47688e
and dword [ebp - 0x19d8], 0
jmp 0x476898
mov dword [ebp - 0x19d8], 1
mov eax, dword [ebp - 0xb14]
cmp dword [ebp - 0x19d8], eax
je 0x4768c8
push 0
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
cmp dword [eax], 0
jne 0x4768c8
push 3
pop eax
test eax, eax
jne 0x4768c8
and dword [ebp - 0xb1c], 0
jmp 0x4768d2
mov dword [ebp - 0xb1c], 1
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x21a0], eax
mov eax, dword [ebp - 0x21a8]
mov dword [ebp - 0x4d4], eax
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x29e4], eax
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x9ec]
call fcn.00433c91
cmp dword [eax], 0xfffffffe
jle 0x476930
push 7
pop eax
test eax, eax
je 0x476930
mov dword [ebp - 0x21b0], 1
jmp 0x476937
and dword [ebp - 0x21b0], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x29ec], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x29f4], eax
mov eax, 0xffff
cmp eax, 3
jb 0x476965
mov dword [ebp - 0x19e0], 1
jmp 0x47696c
and dword [ebp - 0x19e0], 0
cmp dword [ebp - 0x19e0], 0x92eb
jg 0x476984
mov dword [ebp - 0xb24], 1
jmp 0x47698b
and dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x914], eax
jmp 0x47677b
lea ecx, [ebp - 0x9ec]
call fcn.00433c75
mov dword [ebp - 0x240], 0xec2e0cf5
mov dword [ebp - 0x778], 0
jmp 0x4769ca
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x778], 2
jge 0x4769e6
mov eax, dword [ebp - 0x778]
mov dword [ebp + eax*4 - 0x31c8], 6
jmp 0x4769bd
mov byte [ebp - 0x2c5], 0
movzx eax, byte [ebp - 0x2c5]
test eax, eax
je 0x476a03
push 0x35f
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x240], 0
jmp 0x476a1c
mov eax, dword [ebp - 0x240]
dec eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xffffffec
jne 0x476c3c
mov dword [ebp - 0x184], 0xfffffffd
mov dword [ebp - 0x184], 0xfffffff9
jmp 0x476a4c
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x19
jg 0x476c37
mov dword [ebp - 0x3b4], 0x23afc371
mov dword [ebp - 0x21b8], 0xa258
mov dword [ebp - 0x21c8], 1
mov dword [ebp - 0x3b4], 0
jmp 0x476a90
mov eax, dword [ebp - 0x3b4]
dec eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0xfffffff3
jle 0x476c32
mov dword [ebp - 0xb44], 0x1de9829c
cmp dword [ebp - 0x184], 5
jne 0x476abc
mov dword [ebp - 0x1a08], 1
jmp 0x476ac3
and dword [ebp - 0x1a08], 0
cmp dword [ebp - 0x240], 0xb16aac89
jbe 0x476adb
mov dword [ebp - 0x19e8], 1
jmp 0x476ae2
and dword [ebp - 0x19e8], 0
cmp dword [ebp - 0x19e8], 0x7a14
jl 0x476afa
mov dword [ebp - 0xb2c], 1
jmp 0x476b01
and dword [ebp - 0xb2c], 0
cmp dword [ebp - 0xb2c], 1
jge 0x476b16
mov dword [ebp - 0x19f0], 1
jmp 0x476b1d
and dword [ebp - 0x19f0], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x19f0], eax
jg 0x476b3c
or eax, 0xffffffff
je 0x476b3c
mov dword [ebp - 0xb34], 1
jmp 0x476b43
and dword [ebp - 0xb34], 0
cmp dword [ebp - 0xb34], 0xffffffff
jg 0x476b58
mov dword [ebp - 0x19f8], 1
jmp 0x476b5f
and dword [ebp - 0x19f8], 0
mov eax, dword [ebp - 0xb44]
cmp dword [ebp - 0x19f8], eax
jle 0x476b79
mov dword [ebp - 0xb3c], 1
jmp 0x476b80
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0xb3c]
je 0x476b97
cmp dword [ebp - 0x240], 0
jne 0x476b9e
cmp dword [ebp - 0x3b4], 0
mov eax, 0x728ad64d
sub eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x184]
jg 0x476bbd
mov dword [ebp - 0x1a00], 1
jmp 0x476bc4
and dword [ebp - 0x1a00], 0
mov eax, dword [ebp - 0x21b8]
imul eax, dword [ebp - 0x1a00]
sub eax, dword [ebp - 0x184]
neg eax
cmp eax, dword [ebp - 0xb44]
jge 0x476bed
mov dword [ebp - 0xb4c], 1
jmp 0x476bf4
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x1a08]
cmp eax, dword [ebp - 0xb4c]
jne 0x476c0e
mov dword [ebp - 0x21c0], 1
jmp 0x476c15
and dword [ebp - 0x21c0], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x29fc], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x21c8], eax
jmp 0x476a83
jmp 0x476a3f
jmp 0x476a0f
mov dword [ebp - 0x4dc], 0x576c5165
mov dword [ebp - 0x21d0], 0xffffffff
push 4
lea ecx, [ebp - 0x2604]
call fcn.00433ba3
push 1
lea ecx, [ebp - 0x25ec]
call fcn.00433ba3
mov dword [ebp - 0x64], 0
jmp 0x476c7a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x476c90
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3108], 5
jmp 0x476c73
mov dword [ebp - 0x64], 0
jmp 0x476ca0
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x476cbc
push dword [ebp - 0x64]
lea ecx, [ebp - 0x2604]
call fcn.00433c91
mov dword [eax], 0xfffffffa
jmp 0x476c99
mov dword [ebp - 0x64], 0
jmp 0x476ccc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x476ce8
push dword [ebp - 0x64]
lea ecx, [ebp - 0x25ec]
call fcn.00433c91
mov dword [eax], 0xdd7770b1
jmp 0x476cc5
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x4dc], eax
je 0x476d0b
mov eax, 0x6ec7
test eax, eax
je 0x476d0b
mov dword [ebp - 0x1a10], 1
jmp 0x476d12
and dword [ebp - 0x1a10], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x2a04], eax
mov eax, dword [ebp - 0x1a10]
add eax, 0x93de717
cmp eax, dword [ebp - 0x21d0]
jl 0x476d4a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3108], 0
jne 0x476d4a
and dword [ebp - 0xb54], 0
jmp 0x476d54
mov dword [ebp - 0xb54], 1
mov eax, dword [ebp - 0xb54]
imul eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x1a18], eax
push 1
lea ecx, [ebp - 0x2604]
call fcn.00433c91
mov ecx, dword [ebp - 0x1a18]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3108]
cmp dword [ebp - 0x1a18], eax
jle 0x476d9d
mov dword [ebp - 0xb5c], 1
jmp 0x476da4
and dword [ebp - 0xb5c], 0
cmp dword [ebp - 0xb5c], 3
jl 0x476db9
mov dword [ebp - 0x1a20], 1
jmp 0x476dc0
and dword [ebp - 0x1a20], 0
push 0
lea ecx, [ebp - 0x25ec]
call fcn.00433c91
mov ecx, dword [ebp - 0x1a20]
mov dword [eax], ecx
lea ecx, [ebp - 0x25ec]
call fcn.00433c75
lea ecx, [ebp - 0x2604]
call fcn.00433c75
mov dword [ebp - 0x668], 0
jmp 0x476e04
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 2
jge 0x476e20
mov eax, dword [ebp - 0x668]
mov dword [ebp + eax*4 - 0x2888], 0xca54
jmp 0x476df7
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
je 0x476ed9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x28], eax
jge 0x476e4c
mov dword [ebp - 0xb64], 1
jmp 0x476e53
and dword [ebp - 0xb64], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jle 0x476e67
mov dword [ebp - 0x21d8], 1
jmp 0x476e6e
and dword [ebp - 0x21d8], 0
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2a0c], eax
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x12c], eax
jge 0x476e9a
mov dword [ebp - 0x1a28], 1
jmp 0x476ea1
and dword [ebp - 0x1a28], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1a28], eax
jle 0x476eb8
mov dword [ebp - 0xb6c], 1
jmp 0x476ebf
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0xb6c]
test eax, eax
je 0x476ed9
mov dword [ebp - 0x1a30], 1
jmp 0x476ee0
and dword [ebp - 0x1a30], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1a30], eax
jg 0x476ef7
mov dword [ebp - 0xb74], 1
jmp 0x476efe
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0xb74], eax
jge 0x476f18
mov dword [ebp - 0x1a38], 1
jmp 0x476f1f
and dword [ebp - 0x1a38], 0
mov eax, dword [ebp - 0x1a38]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x47a1bc
mov dword [ebp - 0x5c], 0x2e91a04
mov dword [ebp - 0x284], 0x9e71b35
mov dword [ebp - 0x134], 0x215169ff
mov dword [ebp - 0x2a14], 4
mov dword [ebp - 0x21f8], 0xcc21d2cf
mov dword [ebp - 0x2a1c], 2
mov dword [ebp - 0x2200], 0
mov dword [ebp - 0x2a24], 7
mov dword [ebp - 0xbb4], 0xffffffff
mov dword [ebp - 0x2a2c], 0xfffffffd
mov dword [ebp - 0x2a34], 0xb1c2610a
mov dword [ebp - 0x2a3c], 0xfffffff8
mov dword [ebp - 0x9a0], 1
push 2
lea ecx, [ebp - 0x2634]
call fcn.00433ba3
mov dword [ebp - 0x4e4], 0
jmp 0x476fdd
mov eax, dword [ebp - 0x4e4]
inc eax
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 2
jge 0x476fff
push dword [ebp - 0x4e4]
lea ecx, [ebp - 0x2634]
call fcn.00433c91
mov dword [eax], 0xfffffff6
jmp 0x476fd0
mov dword [ebp - 0x5c], 0xfffffff1
jmp 0x47700f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jl 0x47703f
mov byte [ebp - 0x36a], 0
movzx eax, byte [ebp - 0x36a]
test eax, eax
je 0x47703d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x477008
cmp dword [ebp - 0x5c], 1
jle 0x477051
mov dword [ebp - 0x1a48], 1
jmp 0x477058
and dword [ebp - 0x1a48], 0
cmp dword [ebp - 0x5c], 0
jne 0x477070
cmp dword [ebp - 0x284], 0
jne 0x477070
and dword [ebp - 0xb7c], 0
jmp 0x47707a
mov dword [ebp - 0xb7c], 1
cmp dword [ebp - 0xb7c], 0xd8a
jle 0x477092
mov dword [ebp - 0x1a40], 1
jmp 0x477099
and dword [ebp - 0x1a40], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1a40], eax
je 0x4770b0
mov dword [ebp - 0x21e0], 1
jmp 0x4770b7
and dword [ebp - 0x21e0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x2a44], eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x5c]
cmp eax, 0xfa97f51e
jbe 0x4770d9
mov dword [ebp - 0xb84], 1
jmp 0x4770e0
and dword [ebp - 0xb84], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0xb84], eax
jl 0x477100
cmp dword [ebp - 0x134], 0
jne 0x477100
and dword [ebp - 0xb8c], 0
jmp 0x47710a
mov dword [ebp - 0xb8c], 1
mov eax, dword [ebp - 0x1a48]
cmp eax, dword [ebp - 0xb8c]
jne 0x47712d
cmp dword [ebp - 0x284], 0
je 0x47712d
mov dword [ebp - 0x1a50], 1
jmp 0x477134
and dword [ebp - 0x1a50], 0
mov eax, dword [ebp - 0x1a50]
sub eax, 0x37f4
jmp 0x47714d
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0xb94], eax
je 0x47716b
mov dword [ebp - 0x1a58], 1
jmp 0x477172
and dword [ebp - 0x1a58], 0
mov eax, dword [ebp - 0x1a58]
sub eax, dword [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
je 0x477430
push 1
lea ecx, [ebp - 0x261c]
call fcn.00433ba3
mov dword [ebp - 0x21e8], 2
mov dword [ebp - 0x21f0], 1
mov dword [ebp - 0x2a4c], 0xfd5f3964
mov dword [ebp - 0x1d8], 0
jmp 0x4771c8
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jge 0x4771e4
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xa48], 0xec0dcee
jmp 0x4771bb
mov dword [ebp - 0x1d8], 0
jmp 0x4771fd
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x47721f
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x261c]
call fcn.00433c91
mov dword [eax], 0xfffffff6
jmp 0x4771f0
mov dword [ebp - 0x134], 0
jmp 0x477238
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jg 0x477420
mov dword [ebp - 0x3020], 1
mov dword [ebp - 0x301c], 1
mov dword [ebp - 0x3018], 1
mov dword [ebp - 0x3014], 1
mov dword [ebp - 0x2a54], 0xeac691c6
mov dword [ebp - 0x2a5c], 0x962d
push 2
lea ecx, [ebp - 0x2d64]
call fcn.00433ba3
mov dword [ebp - 0x720], 0
jmp 0x4772a7
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 2
jge 0x4772c9
push dword [ebp - 0x720]
lea ecx, [ebp - 0x2d64]
call fcn.00433c91
mov dword [eax], 0xf4d21fd0
jmp 0x47729a
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp + eax*4 - 0xa48]
mov dword [ebp - 0x2a64], eax
mov eax, 0xa36fe543
test eax, eax
je 0x47730a
cmp dword [ebp - 0x284], 0
je 0x47730a
mov eax, dword [ebp - 0x134]
cmp dword [ebp + eax*4 - 0xa48], 0
je 0x47730a
mov dword [ebp - 0xb9c], 1
jmp 0x477311
and dword [ebp - 0xb9c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
mov edx, dword [ebp - 0xb9c]
sub edx, dword [ebp + ecx*4 - 0xa48]
push 4
pop ecx
imul ecx, ecx, 0
add edx, dword [ebp + ecx - 0xa48]
cmp dword [ebp + eax - 0xa48], edx
jle 0x47734c
mov dword [ebp - 0x848], 1
jmp 0x477353
and dword [ebp - 0x848], 0
push 0
lea ecx, [ebp - 0x261c]
call fcn.00433c91
mov ecx, dword [ebp - 0x848]
mov dword [eax], ecx
cmp dword [ebp - 0x848], 0
jne 0x477383
cmp dword [ebp - 0x284], 0
jne 0x477383
and dword [ebp - 0x1a60], 0
jmp 0x47738d
mov dword [ebp - 0x1a60], 1
mov eax, dword [ebp - 0x1a60]
sub eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x21e8]
imul eax, eax, 0
cmp eax, 0x8af8
jle 0x4773b2
mov dword [ebp - 0xba4], 1
jmp 0x4773b9
and dword [ebp - 0xba4], 0
cmp dword [ebp - 0xba4], 0x3d47
jl 0x4773d1
mov dword [ebp - 0x1a68], 1
jmp 0x4773d8
and dword [ebp - 0x1a68], 0
mov eax, dword [ebp - 0x1a68]
mov dword [ebp - 0x21f0], eax
mov eax, dword [ebp - 0x9a0]
dec eax
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp + eax*4 - 0xa48]
add eax, dword [ebp - 0x284]
add eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x21f8], eax
lea ecx, [ebp - 0x2d64]
call fcn.00433c75
jmp 0x47722b
lea ecx, [ebp - 0x261c]
call fcn.00433c75
jmp 0x477504
mov dword [ebp - 0x23bc], 0xffffffff
mov dword [ebp - 0x23b8], 0xffffffff
mov dword [ebp - 0x23b4], 0xffffffff
mov dword [ebp - 0x23b0], 0xffffffff
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x23bc]
mov dword [ebp - 0x2200], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2a6c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x23bc], 0
jne 0x4774a4
push 0
lea ecx, [ebp - 0x2634]
call fcn.00433c91
cmp dword [ebp - 0x284], 0
jne 0x4774a4
and dword [ebp - 0xbac], 0
jmp 0x4774ae
mov dword [ebp - 0xbac], 1
cmp dword [ebp - 0xbac], 1
jae 0x4774c3
mov dword [ebp - 0x1a70], 1
jmp 0x4774ca
and dword [ebp - 0x1a70], 0
mov eax, dword [ebp - 0xbb4]
add eax, dword [ebp - 0x1a70]
cmp dword [ebp - 0xbb4], eax
jge 0x4774ea
mov dword [ebp - 0x1a78], 1
jmp 0x4774f1
and dword [ebp - 0x1a78], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a78]
mov dword [ebp + eax - 0x23bc], ecx
lea ecx, [ebp - 0x2634]
call fcn.00433c75
mov dword [ebp - 0x238], 0xfffffff8
mov dword [ebp - 0x384], 0xc45cdbe8
mov dword [ebp - 0x2210], 8
mov dword [ebp - 0x4ec], 0
jmp 0x477546
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 2
jge 0x477562
mov eax, dword [ebp - 0x4ec]
mov dword [ebp + eax*4 - 0x1f5c], 0xffffffff
jmp 0x477539
mov dword [ebp - 0x384], 1
jmp 0x47757b
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jl 0x4775f5
mov dword [ebp - 0x448], 0x210b999f
mov dword [ebp - 0x448], 1
jmp 0x4775a7
mov eax, dword [ebp - 0x448]
dec eax
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jl 0x4775d6
mov dword [ebp - 0x2208], 0x63e8e1b8
mov eax, dword [ebp - 0x448]
mov eax, dword [ebp + eax*4 - 0x1f5c]
imul eax, dword [ebp - 0x2208]
mov dword [ebp - 0x2210], eax
jmp 0x47759a
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0x384]
mov eax, dword [ebp + eax*4 - 0x1f5c]
mov dword [ebp + ecx*4 - 0x1f5c], eax
jmp 0x47756e
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x477611
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
push 4
lea ecx, [ebp - 0x9b8]
call fcn.00433ba3
mov dword [ebp - 0x2a74], 9
mov dword [ebp - 0x2a7c], 9
mov dword [ebp - 0x2a84], 0xffffffff
mov dword [ebp - 0x2a8c], 0x4b811476
mov dword [ebp - 0x2a94], 0x9ed080c1
mov dword [ebp - 0x2a9c], 0x9978f3c3
mov dword [ebp - 0x2aa4], 0xfffffffd
mov dword [ebp - 0x2aac], 0xfffffffb
mov dword [ebp - 0xbbc], 0xfffffff8
mov dword [ebp - 0x2ab4], 0x6974edf0
mov dword [ebp - 0x670], 0
jmp 0x47769b
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 2
jge 0x4776b7
mov eax, dword [ebp - 0x670]
mov dword [ebp + eax*4 - 0x3220], 0xb3f36565
jmp 0x47768e
mov eax, dword [ebp - 0xbbc]
inc eax
mov dword [ebp - 0xbbc], eax
push 2
lea ecx, [ebp - 0x2d74]
call fcn.00433ba3
mov dword [ebp - 0x7a8], 5
mov dword [ebp - 0x4f4], 0
jmp 0x4776f4
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 2
jge 0x477713
push dword [ebp - 0x4f4]
lea ecx, [ebp - 0x2d74]
call fcn.00433c91
or dword [eax], 0xffffffff
jmp 0x4776e7
mov dword [ebp - 0x7a8], 0
jmp 0x47772c
mov eax, dword [ebp - 0x7a8]
inc eax
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x7a8], 1
jg 0x47775a
mov byte [ebp - 0x362], 0
movzx eax, byte [ebp - 0x362]
test eax, eax
je 0x477758
push 0x1f77
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x47771f
lea ecx, [ebp - 0x2d74]
call fcn.00433c75
mov dword [ebp - 0x4fc], 0
jmp 0x47777e
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 4
jge 0x4777a0
push dword [ebp - 0x4fc]
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
mov dword [eax], 0x457023
jmp 0x477771
mov dword [ebp - 0x2abc], 0x90a35f39
mov dword [ebp - 0x2838], 0xfffffff7
mov dword [ebp - 0x2834], 0xfffffff7
mov dword [ebp - 0x2830], 0xfffffff7
mov dword [ebp - 0x282c], 0xfffffff7
mov dword [ebp - 0x2ac4], 0x6715f0ed
mov dword [ebp - 0xbcc], 0xfffffff8
mov dword [ebp - 0x2220], 0x5954e3f1
mov dword [ebp - 0x2acc], 1
mov dword [ebp - 0x2ad4], 0x57a1
push 1
lea ecx, [ebp - 0x2664]
call fcn.00433ba3
push 3
lea ecx, [ebp - 0x264c]
call fcn.00433ba3
mov dword [ebp - 0x2adc], 0x2f34c933
mov dword [ebp - 0x850], 0xa87
mov dword [ebp - 0xbc4], 1
mov dword [ebp - 0x158], 0
jmp 0x477855
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x477877
push dword [ebp - 0x158]
lea ecx, [ebp - 0x2664]
call fcn.00433c91
mov dword [eax], 0xa5bed857
jmp 0x477848
mov dword [ebp - 0x158], 0
jmp 0x477890
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x4778b2
push dword [ebp - 0x158]
lea ecx, [ebp - 0x264c]
call fcn.00433c91
mov dword [eax], 0x4bca925f
jmp 0x477883
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0x2ae4], eax
push 0
lea ecx, [ebp - 0x2664]
call fcn.00433c91
cmp dword [eax], 0
je 0x477919
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x2838]
push 0
lea ecx, [ebp - 0x264c]
call fcn.00433c91
cmp esi, dword [eax]
jg 0x4778fa
mov dword [ebp - 0x1a80], 1
jmp 0x477901
and dword [ebp - 0x1a80], 0
cmp dword [ebp - 0x1a80], 0x785e
jge 0x477919
mov dword [ebp - 0x2218], 1
jmp 0x477920
and dword [ebp - 0x2218], 0
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbc4]
mov ecx, dword [ebp - 0x850]
dec ecx
mov dword [ebp - 0x850], ecx
cmp eax, 0xc04b
je 0x47795b
cmp dword [ebp - 0x2220], 0
je 0x47795b
mov dword [ebp - 0x1a88], 1
jmp 0x477962
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1a88]
mov dword [ebp - 0xbcc], eax
lea ecx, [ebp - 0x264c]
call fcn.00433c75
lea ecx, [ebp - 0x2664]
call fcn.00433c75
mov eax, 0xbac89d73
test eax, eax
je 0x4779ab
push 0
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
cmp dword [eax], 0
je 0x4779ab
mov dword [ebp - 0x2228], 1
jmp 0x4779b2
and dword [ebp - 0x2228], 0
mov dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x2aec], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2af4], eax
cmp dword [ebp - 0x28], 0xffffffff
jle 0x4779e3
mov dword [ebp - 0x1a90], 1
jmp 0x4779ea
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1a90], eax
je 0x477a01
mov dword [ebp - 0xbd4], 1
jmp 0x477a08
and dword [ebp - 0xbd4], 0
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x238], eax
mov esi, dword [ebp - 0x238]
push 3
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
cmp dword [eax], esi
jg 0x477a43
mov dword [ebp - 0x2230], 1
jmp 0x477a4a
and dword [ebp - 0x2230], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x2afc], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x80], eax
jg 0x477a6a
mov dword [ebp - 0x1a98], 1
jmp 0x477a71
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1a98], eax
jge 0x477a88
mov dword [ebp - 0xbdc], 1
jmp 0x477a8f
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x478ee3
mov dword [ebp - 0x1b0], 0xfb0b0297
mov dword [ebp - 0x678], 0
jmp 0x477acb
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 3
jge 0x477ae7
mov eax, dword [ebp - 0x678]
mov dword [ebp + eax*4 - 0x267c], 0xffffffff
jmp 0x477abe
mov dword [ebp - 0x1b0], 0
jmp 0x477b00
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jg 0x477b25
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x477b23
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x477af3
mov dword [ebp - 0x1b0], 5
jmp 0x477b3e
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x12
je 0x477da9
mov dword [ebp - 0x220], 0xc170cd50
mov dword [ebp - 0x2240], 0xcaa5d732
mov dword [ebp - 0x2260], 0xb9567464
mov dword [ebp - 0x220], 0xfffffffb
jmp 0x477b82
cmp dword [ebp - 0x220], 0xfffffffd
jle 0x477da4
mov dword [ebp - 0xbf4], 0x6548
mov dword [ebp - 0x2250], 3
mov dword [ebp - 0x2258], 0xfffffffe
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x267c]
cmp dword [ebp - 0x220], eax
je 0x477bcd
mov dword [ebp - 0x2238], 1
jmp 0x477bd4
and dword [ebp - 0x2238], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xbf4]
cmp dword [ebp + eax - 0x267c], ecx
je 0x477bf4
mov dword [ebp - 0x1aa0], 1
jmp 0x477bfb
and dword [ebp - 0x1aa0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x267c]
cmp dword [ebp - 0x1aa0], eax
je 0x477c1b
mov dword [ebp - 0xbe4], 1
jmp 0x477c22
and dword [ebp - 0xbe4], 0
cmp dword [ebp - 0xbe4], 0xfffffff7
jg 0x477c37
mov dword [ebp - 0x1aa8], 1
jmp 0x477c3e
and dword [ebp - 0x1aa8], 0
mov eax, dword [ebp - 0x1aa8]
mov dword [ebp - 0x2240], eax
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x220], eax
jle 0x477c64
mov dword [ebp - 0xbec], 1
jmp 0x477c6b
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0xbec], eax
jl 0x477c85
mov dword [ebp - 0x2248], 1
jmp 0x477c8c
and dword [ebp - 0x2248], 0
mov eax, 0x949
test eax, eax
je 0x477caa
mov eax, 0x62d5
test eax, eax
je 0x477caa
mov dword [ebp - 0x1ab0], 1
jmp 0x477cb1
and dword [ebp - 0x1ab0], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x1ab0], eax
jg 0x477cd4
cmp dword [ebp - 0xbf4], 0
je 0x477cd4
mov dword [ebp - 0x1ab8], 1
jmp 0x477cdb
and dword [ebp - 0x1ab8], 0
xor eax, eax
sub eax, dword [ebp - 0x1ab8]
add eax, 0x243b9c30
imul eax, eax, 0xfff8
cmp eax, 0x8131dda8
je 0x477d01
mov dword [ebp - 0xbfc], 1
jmp 0x477d08
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x2250]
cmp dword [ebp - 0xbfc], eax
je 0x477d22
mov dword [ebp - 0x1ac0], 1
jmp 0x477d29
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x2258]
cmp dword [ebp - 0x1ac0], eax
je 0x477d43
mov dword [ebp - 0xc04], 1
jmp 0x477d4a
and dword [ebp - 0xc04], 0
cmp dword [ebp - 0xc04], 3
jne 0x477d5f
jmp 0x477b31
mov dword [ebp - 0x50c], 0x179b2c39
push 2
lea ecx, [ebp - 0x1d08]
call fcn.00433ba3
mov dword [ebp - 0x294], 0x5c8094a
mov dword [ebp - 0x504], 0
jmp 0x477de3
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 2
jge 0x477e05
push dword [ebp - 0x504]
lea ecx, [ebp - 0x1d08]
call fcn.00433c91
mov dword [eax], 0x9f9b
jmp 0x477dd6
mov dword [ebp - 0x294], 0
jmp 0x477e1e
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jg 0x47803e
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x2268], 0xfffffff6
mov dword [ebp - 0x1ad8], 0x5dea311c
mov dword [ebp - 0xc1c], 0x33fd52a4
mov dword [ebp - 0x2270], 2
mov dword [ebp - 0xa0], 1
jmp 0x477e76
cmp dword [ebp - 0xa0], 0
jl 0x478039
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1d08]
call fcn.00433c91
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1d08]
call fcn.00433c91
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2b04], eax
cmp dword [ebp - 0x294], 0
jne 0x477ecc
cmp dword [ebp - 0x2268], 0
jne 0x477ecc
and dword [ebp - 0xc0c], 0
jmp 0x477ed6
mov dword [ebp - 0xc0c], 1
mov esi, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xc0c]
neg edi
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1d08]
call fcn.00433c91
imul edi, dword [eax]
cmp esi, edi
jg 0x477f08
mov dword [ebp - 0x1ad0], 1
jmp 0x477f0f
and dword [ebp - 0x1ad0], 0
mov eax, dword [ebp - 0x1ad0]
neg eax
je 0x477f2e
cmp dword [ebp - 0xa0], 0
je 0x477f2e
mov dword [ebp - 0xc14], 1
jmp 0x477f35
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0x1ad8], eax
mov eax, dword [ebp - 0x1ad8]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xc1c], 0
je 0x477f66
xor eax, eax
je 0x477f66
mov dword [ebp - 0x1ae0], 1
jmp 0x477f6d
and dword [ebp - 0x1ae0], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1d08]
call fcn.00433c91
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1ae0]
jl 0x477f94
mov dword [ebp - 0xc24], 1
jmp 0x477f9b
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xc24], eax
jg 0x477fb5
mov dword [ebp - 0x1ae8], 1
jmp 0x477fbc
and dword [ebp - 0x1ae8], 0
imul eax, dword [ebp - 0x1ae8], 0xf617
test eax, eax
jne 0x477fe5
cmp dword [ebp - 0x294], 0
jne 0x477fe5
mov dword [ebp - 0xc2c], 1
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x1d08]
call fcn.00433c91
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc2c]
jl 0x478016
jmp 0x477e11
lea ecx, [ebp - 0x1d08]
call fcn.00433c75
mov dword [ebp - 0x2288], 0xef5427e5
mov dword [ebp - 0x400], 0xffffffff
mov dword [ebp - 0x400], 0xffffffe2
jmp 0x478076
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0x16
jg 0x47810f
push 3
lea ecx, [ebp - 0x2458]
call fcn.00433ba3
mov dword [ebp - 0x2278], 0xf0aa
mov dword [ebp - 0x728], 0
jmp 0x4780b3
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0x728], 3
jge 0x4780d5
push dword [ebp - 0x728]
lea ecx, [ebp - 0x2458]
call fcn.00433c91
mov dword [eax], 5
jmp 0x4780a6
push 0
lea ecx, [ebp - 0x2458]
call fcn.00433c91
mov esi, dword [ebp - 0x2278]
sub esi, dword [ebp - 0x400]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x2458]
call fcn.00433c91
mov dword [eax], esi
lea ecx, [ebp - 0x2458]
call fcn.00433c75
jmp 0x478069
cmp dword [ebp - 0x2280], 0
jne 0x4781b1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2888]
cmp dword [ebp - 0x50c], eax
jle 0x47813d
mov dword [ebp - 0xc34], 1
jmp 0x478144
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0xc34], eax
je 0x47815e
mov dword [ebp - 0x1af8], 1
jmp 0x478165
and dword [ebp - 0x1af8], 0
mov eax, dword [ebp - 0x1af8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
add eax, 0x30e92f9e
je 0x478185
cmp dword [ebp - 0x12c], 0
push 0
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
push 0
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
cmp dword [eax], 0
jne 0x4781b1
push 0
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x50c], eax
je 0x4781cb
mov dword [ebp - 0xc3c], 1
jmp 0x4781d2
and dword [ebp - 0xc3c], 0
push 1
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
mov ecx, dword [ebp - 0xc3c]
cmp ecx, dword [eax]
jle 0x478204
push 3
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
cmp dword [eax], 0
jne 0x478204
and dword [ebp - 0x1b00], 0
jmp 0x47820e
mov dword [ebp - 0x1b00], 1
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x1b00], eax
jge 0x478228
mov dword [ebp - 0xc44], 1
jmp 0x47822f
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0xc44], eax
jg 0x478249
mov dword [ebp - 0x1b08], 1
jmp 0x478250
and dword [ebp - 0x1b08], 0
mov esi, dword [ebp - 0x80]
push 0
lea ecx, [ebp - 0x9b8]
call fcn.00433c91
imul esi, dword [eax]
cmp esi, dword [ebp - 0x1b08]
jle 0x478277
mov dword [ebp - 0xc4c], 1
jmp 0x47827e
and dword [ebp - 0xc4c], 0
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x2288], eax
push 3
lea ecx, [ebp - 0x2694]
call fcn.00433ba3
mov dword [ebp - 0x2290], 5
mov dword [ebp - 0x680], 0
jmp 0x4782ba
cmp dword [ebp - 0x680], 3
jge 0x4782dc
mov dword [ebp - 0x408], 0x11c15747
mov dword [ebp - 0x534], 0x5f0ed1ad
mov dword [ebp - 0x24e0], 0xcad7d711
mov dword [ebp - 0x24dc], 0xcad7d711
mov dword [ebp - 0x24d8], 0xcad7d711
mov dword [ebp - 0x24d4], 0xcad7d711
lea ecx, [ebp - 0x8e1]
call fcn.00433ca0
push eax
lea eax, [ebp - 0x24d0]
push eax
lea eax, [ebp - 0x24e0]
push eax
lea ecx, [ebp - 0x3230]
call fcn.00433ca3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d44]
call fcn.00433c4f
mov dword [ebp - 0xd1c], 0xffffffff
mov dword [ebp - 0x690], 0xffff
mov dword [ebp - 0xd2c], 0xffffffff
mov dword [ebp - 0x52c], 0
jmp 0x478f8b
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 2
jge 0x478fa7
mov eax, dword [ebp - 0x52c]
mov dword [ebp + eax*4 - 0x2894], 0x297f1ff7
jmp 0x478f7e
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x2b34], eax
mov eax, dword [ebp - 0x690]
inc eax
mov dword [ebp - 0x690], eax
cmp dword [ebp - 0x690], 8
ja 0x478fd5
mov dword [ebp - 0x984], 1
jmp 0x478fdc
and dword [ebp - 0x984], 0
push 3
lea ecx, [ebp - 0x1d44]
call fcn.00433c91
mov ecx, dword [ebp - 0x984]
mov dword [eax], ecx
cmp dword [ebp - 0x984], 0
jne 0x4791d6
cmp dword [ebp - 0x534], 1
jb 0x479013
mov dword [ebp - 0xcfc], 1
jmp 0x47901a
and dword [ebp - 0xcfc], 0
cmp dword [ebp - 0xcfc], 0xfffb
jbe 0x479032
mov dword [ebp - 0x1a74], 1
jmp 0x479039
and dword [ebp - 0x1a74], 0
cmp dword [ebp - 0x1a74], 0xf36f
jge 0x479051
mov dword [ebp - 0xd04], 1
jmp 0x479058
and dword [ebp - 0xd04], 0
cmp dword [ebp - 0xd04], 6
je 0x47906d
mov dword [ebp - 0x14b4], 1
jmp 0x479074
and dword [ebp - 0x14b4], 0
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x14b4], eax
jg 0x47908e
mov dword [ebp - 0xd0c], 1
jmp 0x479095
and dword [ebp - 0xd0c], 0
push 1
lea ecx, [ebp - 0x1d44]
call fcn.00433c91
mov ecx, dword [ebp - 0xd0c]
cmp ecx, dword [eax]
jge 0x4790b8
mov dword [ebp - 0x188c], 1
jmp 0x4790bf
and dword [ebp - 0x188c], 0
cmp dword [ebp - 0x188c], 0xc3cbaa6f
jb 0x4790d7
mov dword [ebp - 0x1dd4], 1
jmp 0x4790de
and dword [ebp - 0x1dd4], 0
cmp dword [ebp - 0x408], 0x18eb
jge 0x4790f6
mov dword [ebp - 0x215c], 1
jmp 0x4790fd
and dword [ebp - 0x215c], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x2b3c], eax
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x408]
je 0x479132
push 1
lea ecx, [ebp - 0x1d44]
call fcn.00433c91
cmp dword [eax], 0
je 0x479132
mov dword [ebp - 0x860], 1
jmp 0x479139
and dword [ebp - 0x860], 0
push 0
lea ecx, [ebp - 0x1d44]
call fcn.00433c91
mov ecx, dword [ebp - 0x860]
mov dword [eax], ecx
mov eax, dword [ebp - 0x534]
cmp dword [ebp - 0x860], eax
jne 0x479168
mov dword [ebp - 0xd14], 1
jmp 0x47916f
and dword [ebp - 0xd14], 0
cmp dword [ebp - 0xd14], 1
je 0x479184
mov dword [ebp - 0x14bc], 1
jmp 0x47918b
and dword [ebp - 0x14bc], 0
mov eax, dword [ebp - 0x14bc]
add eax, 4
cmp eax, dword [ebp - 0xd1c]
je 0x4791a8
mov dword [ebp - 0x1ddc], 1
jmp 0x4791af
and dword [ebp - 0x1ddc], 0
mov eax, dword [ebp - 0xd1c]
mov dword [ebp - 0x2b44], eax
push 0
lea ecx, [ebp - 0x1d44]
call fcn.00433c91
cmp dword [eax], 0
jne 0x4791d6
and dword [ebp - 0x1b6c], 0
jmp 0x4791e0
mov dword [ebp - 0x1b6c], 1
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x1b6c], eax
jne 0x4791fa
mov dword [ebp - 0xd24], 1
jmp 0x479201
and dword [ebp - 0xd24], 0
mov eax, dword [ebp - 0x534]
imul eax, dword [ebp - 0xd24]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2894], eax
mov eax, dword [ebp - 0x408]
add eax, dword [ebp - 0xd2c]
imul eax, eax, 0x5e8a
test eax, eax
je 0x47924f
push 1
lea ecx, [ebp - 0x1d44]
call fcn.00433c91
cmp dword [eax], 0
je 0x47924f
mov dword [ebp - 0x14c4], 1
jmp 0x479256
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0x14c4]
mov dword [ebp - 0xd2c], eax
lea ecx, [ebp - 0x1d44]
call fcn.00433c75
mov dword [ebp - 0x99c], 0x2166a3c8
mov dword [ebp - 0x2b4c], 0x90a35f39
mov dword [ebp - 0x2858], 0xfffffff7
mov dword [ebp - 0x2854], 0xfffffff7
mov dword [ebp - 0x2850], 0xfffffff7
mov dword [ebp - 0x284c], 0xfffffff7
mov dword [ebp - 0x2b54], 0x6715f0ed
mov dword [ebp - 0xd3c], 0xfffffff8
mov dword [ebp - 0x1de4], 0x5954e3f1
mov dword [ebp - 0x2b5c], 1
mov dword [ebp - 0x2b64], 0x57a1
push 1
lea ecx, [ebp - 0x2748]
call fcn.00433ba3
push 3
lea ecx, [ebp - 0x26ac]
call fcn.00433ba3
mov dword [ebp - 0x2b6c], 0x2f34c933
mov dword [ebp - 0x924], 0xa87
mov dword [ebp - 0xd34], 1
mov dword [ebp - 0x1f0], 0
jmp 0x47932c
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x47934e
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x2748]
call fcn.00433c91
mov dword [eax], 0xa5bed857
jmp 0x47931f
mov dword [ebp - 0x1f0], 0
jmp 0x479367
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x479389
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0x26ac]
call fcn.00433c91
mov dword [eax], 0x4bca925f
jmp 0x47935a
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0x2b74], eax
push 0
lea ecx, [ebp - 0x2748]
call fcn.00433c91
cmp dword [eax], 0
je 0x4793f0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x2858]
push 0
lea ecx, [ebp - 0x26ac]
call fcn.00433c91
cmp esi, dword [eax]
jg 0x4793d1
mov dword [ebp - 0x1894], 1
jmp 0x4793d8
and dword [ebp - 0x1894], 0
cmp dword [ebp - 0x1894], 0x785e
jge 0x4793f0
mov dword [ebp - 0x2254], 1
jmp 0x4793f7
and dword [ebp - 0x2254], 0
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0xd34]
mov ecx, dword [ebp - 0x924]
dec ecx
mov dword [ebp - 0x924], ecx
cmp eax, 0xc04b
je 0x479432
cmp dword [ebp - 0x1de4], 0
je 0x479432
mov dword [ebp - 0x14cc], 1
jmp 0x479439
and dword [ebp - 0x14cc], 0
mov eax, dword [ebp - 0x14cc]
mov dword [ebp - 0xd3c], eax
lea ecx, [ebp - 0x26ac]
call fcn.00433c75
lea ecx, [ebp - 0x2748]
call fcn.00433c75
mov dword [ebp - 0xdf4], 0xfffffffb
mov dword [ebp - 0x1e1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xd0], 5
mov dword [ebp - 0x225c], 0x7cad959f
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x2b7c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2b84], eax
cmp dword [ebp - 0x14], 0x7e43
jl 0x4794c1
mov dword [ebp - 0x1a7c], 1
jmp 0x4794c8
and dword [ebp - 0x1a7c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1a7c], eax
jg 0x4794df
mov dword [ebp - 0xd44], 1
jmp 0x4794e6
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd44], eax
jle 0x4794fd
mov dword [ebp - 0x14d4], 1
jmp 0x479504
and dword [ebp - 0x14d4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14d4], eax
jg 0x47951b
mov dword [ebp - 0xd4c], 1
jmp 0x479522
and dword [ebp - 0xd4c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd4c], eax
je 0x479539
mov dword [ebp - 0x2164], 1
jmp 0x479540
and dword [ebp - 0x2164], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2b8c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jge 0x47955d
mov dword [ebp - 0x189c], 1
jmp 0x479564
and dword [ebp - 0x189c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x189c], eax
jge 0x47957b
mov dword [ebp - 0xd54], 1
jmp 0x479582
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd54], eax
je 0x479599
mov dword [ebp - 0x10c], 0x69fdf99f
mov dword [ebp - 0x92c], 1
mov dword [ebp - 0x1e2c], 0xa3888ad
mov dword [ebp - 0x554], 0
jmp 0x47a1f3
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 3
jge 0x47a20f
mov eax, dword [ebp - 0x554]
mov dword [ebp + eax*4 - 0x3178], 0xf2f3
jmp 0x47a1e6
mov dword [ebp - 0x10c], 0
jmp 0x47a228
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffec
jne 0x47a4e5
mov dword [ebp - 0x450], 0x34f09465
mov dword [ebp - 0x1a94], 0x6887e08
mov dword [ebp - 0x1e24], 0xfffffffd
push 1
lea ecx, [ebp - 0x2778]
call fcn.00433ba3
mov dword [ebp - 0x1b7c], 0xffffffff
mov dword [ebp - 0x788], 0
jmp 0x47a283
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 1
jge 0x47a2a2
push dword [ebp - 0x788]
lea ecx, [ebp - 0x2778]
call fcn.00433c91
or dword [eax], 0xffffffff
jmp 0x47a276
mov byte [ebp - 0x359], 0
movzx eax, byte [ebp - 0x359]
test eax, eax
je 0x47a2d1
push 0
push 0
push 0
push 0
push 0x15ce
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2c04], eax
mov dword [ebp - 0x1a94], 0x292c
mov eax, dword [ebp - 0x1a94]
cmp dword [ebp - 0x450], eax
jle 0x47a301
mov dword [ebp - 0xe1c], 1
jmp 0x47a308
and dword [ebp - 0xe1c], 0
cmp dword [ebp - 0x10c], 0
jle 0x47a31d
mov dword [ebp - 0xe04], 1
jmp 0x47a324
and dword [ebp - 0xe04], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0xe04], eax
jle 0x47a33e
mov dword [ebp - 0x1534], 1
jmp 0x47a345
and dword [ebp - 0x1534], 0
cmp dword [ebp - 0x1534], 0x3af7806a
je 0x47a35d
mov dword [ebp - 0xe0c], 1
jmp 0x47a364
and dword [ebp - 0xe0c], 0
mov eax, dword [ebp - 0xe0c]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x92c], eax
jne 0x47a38a
mov dword [ebp - 0x18cc], 1
jmp 0x47a391
and dword [ebp - 0x18cc], 0
mov eax, dword [ebp - 0x450]
cmp dword [ebp - 0x18cc], eax
je 0x47a3ab
mov dword [ebp - 0xe14], 1
jmp 0x47a3b2
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0xe14]
cmp eax, dword [ebp - 0x450]
jge 0x47a3d3
mov dword [ebp - 0x153c], 1
jmp 0x47a3da
and dword [ebp - 0x153c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3178]
cmp dword [ebp - 0x153c], eax
jne 0x47a3fb
mov dword [ebp - 0x2264], 1
jmp 0x47a402
and dword [ebp - 0x2264], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x2c0c], eax
mov eax, dword [ebp - 0x1e24]
mov dword [ebp - 0x2c14], eax
or eax, 0xffffffff
cmp eax, 1
ja 0x47a42e
mov dword [ebp - 0x2184], 1
jmp 0x47a435
and dword [ebp - 0x2184], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x2c1c], eax
mov eax, dword [ebp - 0x450]
cmp dword [ebp - 0xe1c], eax
jne 0x47a45b
mov dword [ebp - 0x870], 1
jmp 0x47a462
and dword [ebp - 0x870], 0
push 0
lea ecx, [ebp - 0x2778]
call fcn.00433c91
mov ecx, dword [ebp - 0x870]
mov dword [eax], ecx
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x1b7c], eax
cmp dword [ebp - 0x1b7c], 0
jne 0x47a49e
cmp dword [ebp - 0x92c], 0
jne 0x47a49e
and dword [ebp - 0xe24], 0
jmp 0x47a4a8
mov dword [ebp - 0xe24], 1
cmp dword [ebp - 0xe24], 0xb400
jg 0x47a4c0
mov dword [ebp - 0x1544], 1
jmp 0x47a4c7
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x1544]
dec eax
dec eax
mov dword [ebp - 0x1e2c], eax
lea ecx, [ebp - 0x2778]
call fcn.00433c75
jmp 0x47a21b
mov byte [ebp - 0x2fd], 0
mov dword [ebp - 0x878], 0xfffffff7
mov dword [ebp - 0xe34], 0xbbb66efe
push 3
lea ecx, [ebp - 0x27a8]
call fcn.00433ba3
mov dword [ebp - 0x1a9c], 9
push 3
lea ecx, [ebp - 0x2790]
call fcn.00433ba3
mov dword [ebp - 0x70], 0
jmp 0x47a534
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x47a54a
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x3dc], 0x8c08872f
jmp 0x47a52d
mov dword [ebp - 0x70], 0
jmp 0x47a55a
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x47a573
push dword [ebp - 0x70]
lea ecx, [ebp - 0x27a8]
call fcn.00433c91
or dword [eax], 0xffffffff
jmp 0x47a553
mov dword [ebp - 0x70], 0
jmp 0x47a583
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x47a59f
push dword [ebp - 0x70]
lea ecx, [ebp - 0x2790]
call fcn.00433c91
mov dword [eax], 0xea1bca33
jmp 0x47a57c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3dc], 0
je 0x47a6e3
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x3dc], 0
cmp eax, 0xe2cf4565
je 0x47a5d4
mov dword [ebp - 0xe2c], 1
jmp 0x47a5db
and dword [ebp - 0xe2c], 0
cmp dword [ebp - 0xe2c], 0x8f59172d
ja 0x47a5f3
mov dword [ebp - 0x18d4], 1
jmp 0x47a5fa
and dword [ebp - 0x18d4], 0
mov eax, dword [ebp - 0x18d4]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x878]
neg eax
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0xe34]
mov dword [ebp - 0x2c24], eax
mov eax, 0xbb1a
test eax, eax
jne 0x47a63b
cmp dword [ebp - 0x878], 0
jne 0x47a63b
and dword [ebp - 0x154c], 0
jmp 0x47a645
mov dword [ebp - 0x154c], 1
push 2
lea ecx, [ebp - 0x27a8]
call fcn.00433c91
mov ecx, dword [ebp - 0x154c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp - 0x2c2c], eax
or eax, 0xffffffff
je 0x47a67e
mov dword [ebp - 0xe3c], 1
jmp 0x47a685
and dword [ebp - 0xe3c], 0
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0x1a9c], eax
cmp dword [ebp - 0x1a9c], 0
jne 0x47a6aa
push 6
pop eax
test eax, eax
jne 0x47a6aa
and dword [ebp - 0x235c], 0
jmp 0x47a6b4
mov dword [ebp - 0x235c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
mov dword [ebp - 0x2c34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3dc], 0
je 0x47a6e3
mov dword [ebp - 0xe44], 1
jmp 0x47a6ea
and dword [ebp - 0xe44], 0
cmp dword [ebp - 0xe44], 0x64e6
jle 0x47a702
mov dword [ebp - 0x1554], 1
jmp 0x47a709
and dword [ebp - 0x1554], 0
cmp dword [ebp - 0x1554], 0xfffffffe
jbe 0x47a71e
mov dword [ebp - 0xe4c], 1
jmp 0x47a725
and dword [ebp - 0xe4c], 0
cmp dword [ebp - 0xe4c], 0xfffffffc
jg 0x47a73a
mov dword [ebp - 0x18dc], 1
jmp 0x47a741
and dword [ebp - 0x18dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
cmp dword [ebp - 0x18dc], eax
jl 0x47a762
mov dword [ebp - 0xe54], 1
jmp 0x47a769
and dword [ebp - 0xe54], 0
imul eax, dword [ebp - 0xe54], 0xa9d0
mov esi, 0x89480189
sub esi, eax
push 0
lea ecx, [ebp - 0x2790]
call fcn.00433c91
mov dword [eax], esi
lea ecx, [ebp - 0x2790]
call fcn.00433c75
lea ecx, [ebp - 0x27a8]
call fcn.00433c75
movzx eax, byte [ebp - 0x2fd]
test eax, eax
je 0x47a9d3
mov dword [ebp - 0x38c], 0x42c70bb7
mov dword [ebp - 0x1e3c], 0x9796a0b5
mov dword [ebp - 0x170], 0
jmp 0x47a7db
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x47a7f7
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x155c], 0xfffc
jmp 0x47a7ce
mov dword [ebp - 0x170], 0
jmp 0x47a810
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 4
jge 0x47a82c
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x3048], 0x9193c1de
jmp 0x47a803
mov byte [ebp - 0x35b], 0
movzx eax, byte [ebp - 0x35b]
test eax, eax
je 0x47a84d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [ebp - 0x38c], 0
jmp 0x47a866
mov eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
jl 0x47a9c4
mov dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0
je 0x47a92b
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x29c], eax
jle 0x47a8a4
mov dword [ebp - 0x1e34], 1
jmp 0x47a8ab
and dword [ebp - 0x1e34], 0
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2c3c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2c44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x155c]
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0xe5c]
mov dword [ebp + eax*4 - 0x155c], ecx
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0xe5c], eax
jle 0x47a903
mov dword [ebp - 0x1c44], 1
jmp 0x47a90a
and dword [ebp - 0x1c44], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3048]
cmp dword [ebp - 0x1c44], eax
jne 0x47a92b
mov dword [ebp - 0xe64], 1
jmp 0x47a932
and dword [ebp - 0xe64], 0
cmp dword [ebp - 0xe64], 0x43b8a277
jg 0x47a94a
mov dword [ebp - 0x1fbc], 1
jmp 0x47a951
and dword [ebp - 0x1fbc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3048]
mov dword [ebp - 0x2c4c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x29c]
cmp dword [ebp + eax - 0x3048], ecx
jge 0x47a985
mov dword [ebp - 0x1564], 1
jmp 0x47a98c
and dword [ebp - 0x1564], 0
imul eax, dword [ebp - 0x1564], 0
test eax, eax
jne 0x47a9ac
cmp dword [ebp - 0x29c], 0
jne 0x47a9ac
mov dword [ebp - 0xe6c], 1
jmp 0x47a9b3
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0xe6c]
mov dword [ebp - 0x1e3c], eax
jmp 0x47a859
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0xe74], 0xcd66a075
mov dword [ebp - 0x55c], 0
jmp 0x47aa00
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 3
jge 0x47aa1c
mov eax, dword [ebp - 0x55c]
mov dword [ebp + eax*4 - 0x1db8], 1
jmp 0x47a9f3
mov dword [ebp - 0x1e0], 0
jmp 0x47aa35
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jg 0x47ab77
mov byte [ebp - 0x305], 0
movzx eax, byte [ebp - 0x305]
test eax, eax
je 0x47aa63
push 0
push 0
push 0x11a1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x2c54], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1db8], 0xfffffffe
jne 0x47aa8a
mov dword [ebp - 0x18e4], 1
jmp 0x47aa91
and dword [ebp - 0x18e4], 0
mov eax, dword [ebp - 0x18e4]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0xe74]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x1db8]
mov ecx, dword [ebp - 0x1e0]
cmp eax, dword [ebp + ecx*4 - 0x1db8]
jne 0x47aacb
mov dword [ebp - 0x156c], 1
jmp 0x47aad2
and dword [ebp - 0x156c], 0
cmp dword [ebp - 0x156c], 4
jl 0x47aae7
mov dword [ebp - 0xe7c], 1
jmp 0x47aaee
and dword [ebp - 0xe7c], 0
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x1db8]
cmp dword [ebp - 0xe7c], eax
jg 0x47ab0f
mov dword [ebp - 0x1aa4], 1
jmp 0x47ab16
and dword [ebp - 0x1aa4], 0
mov eax, dword [ebp - 0x1e0]
mov eax, dword [ebp + eax*4 - 0x1db8]
cmp eax, dword [ebp - 0x1aa4]
jle 0x47ab37
mov dword [ebp - 0xe84], 1
jmp 0x47ab3e
and dword [ebp - 0xe84], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0xe84], eax
jl 0x47ab58
mov dword [ebp - 0x1574], 1
jmp 0x47ab5f
and dword [ebp - 0x1574], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1574]
mov dword [ebp + eax - 0x1db8], ecx
jmp 0x47aa28
mov byte [ebp - 0x35d], 0
movzx eax, byte [ebp - 0x35d]
test eax, eax
je 0x47ab98
push 0
push 0xcc
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x16b0], 0x494f
mov dword [ebp - 0x564], 0xe8cff0ea
mov dword [ebp - 0x2c5c], 0
mov dword [ebp - 0x1fd0], 0xd4ea6801
mov dword [ebp - 0x157c], 0x311e2db8
mov dword [ebp - 0x2c64], 0x8407
mov dword [ebp - 0xe9c], 0
mov dword [ebp - 0x6a8], 0
jmp 0x47abf7
mov eax, dword [ebp - 0x6a8]
inc eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 2
jge 0x47ac13
mov eax, dword [ebp - 0x6a8]
mov dword [ebp + eax*4 - 0x3248], 0xfde2bbef
jmp 0x47abea
mov dword [ebp - 0x564], 0xffffffef
jmp 0x47ac2c
mov eax, dword [ebp - 0x564]
dec eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0xffffffee
jl 0x47ad2d
mov dword [ebp - 0x1e44], 0x13281d21
mov dword [ebp - 0x98c], 0x6ec17e5c
mov dword [ebp - 0x23cc], 6
mov dword [ebp - 0x23c8], 6
mov dword [ebp - 0x23c4], 6
mov dword [ebp - 0x23c0], 6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x23cc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x23cc], eax
cmp dword [ebp - 0x1fd0], 0
je 0x47aca0
cmp dword [ebp - 0x1e44], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23cc], 2
jb 0x47acbc
mov dword [ebp - 0xe8c], 1
jmp 0x47acc3
and dword [ebp - 0xe8c], 0
mov eax, dword [ebp - 0x98c]
cmp dword [ebp - 0xe8c], eax
jne 0x47acdd
mov dword [ebp - 0x18ec], 1
jmp 0x47ace4
and dword [ebp - 0x18ec], 0
mov eax, dword [ebp - 0x18ec]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x157c]
cmp dword [ebp - 0x98c], eax
jge 0x47ad11
push 6
pop eax
test eax, eax
je 0x47ad11
mov dword [ebp - 0xe94], 1
jmp 0x47ad18
and dword [ebp - 0xe94], 0
imul eax, dword [ebp - 0xe94], 0xffff
mov dword [ebp - 0x157c], eax
jmp 0x47ac1f
mov eax, dword [ebp - 0xe9c]
inc eax
mov dword [ebp - 0xe9c], eax
push 3
lea ecx, [ebp - 0x2d94]
call fcn.00433ba3
push 3
lea ecx, [ebp - 0x2d84]
call fcn.00433ba3
mov dword [ebp - 0x3bc], 0xfffffff9
mov dword [ebp - 0x178], 0
jmp 0x47ad77
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x47ad96
push dword [ebp - 0x178]
lea ecx, [ebp - 0x2d94]
call fcn.00433c91
and dword [eax], 0
jmp 0x47ad6a
mov dword [ebp - 0x178], 0
jmp 0x47adaf
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x47add1
push dword [ebp - 0x178]
lea ecx, [ebp - 0x2d84]
call fcn.00433c91
mov dword [eax], 0x15a13695
jmp 0x47ada2
mov eax, dword [ebp - 0x3bc]
dec eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3bc], 8
jmp 0x47adf7
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0x39
jle 0x47ae1c
mov byte [ebp - 0x24e], 0
movzx eax, byte [ebp - 0x24e]
test eax, eax
je 0x47ae1a
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x47adea
lea ecx, [ebp - 0x2d84]
call fcn.00433c75
lea ecx, [ebp - 0x2d94]
call fcn.00433c75
mov dword [ebp - 0xc4], 0xe6e7
mov dword [ebp - 0x740], 1
mov dword [ebp - 0x458], 0xfffffffc
mov dword [ebp - 0x410], 0x49c23edb
mov dword [ebp - 0xeb4], 9
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x56c], 0x4204102
mov dword [ebp - 0x418], 0x8325423b
mov dword [ebp - 0x1fe8], 0x7be4
mov dword [ebp - 0x2c6c], 0xfffffffc
mov dword [ebp - 0x1e64], 0x4e1b820f
cmp dword [ebp - 0xc4], 0xfffffffb
jl 0x47aeb5
mov dword [ebp - 0xebc], 1
jmp 0x47aebc
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x2c74], eax
cmp dword [ebp - 0xc4], 3
jae 0x47aedd
mov dword [ebp - 0x1b84], 1
jmp 0x47aee4
and dword [ebp - 0x1b84], 0
cmp dword [ebp - 0x1b84], 0xffff
jne 0x47aefc
mov dword [ebp - 0xea4], 1
jmp 0x47af03
and dword [ebp - 0xea4], 0
mov eax, dword [ebp - 0xea4]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x740], eax
jge 0x47af2f
mov eax, 0xaf9f7c8b
test eax, eax
jne 0x47af2f
and dword [ebp - 0x1584], 0
jmp 0x47af39
mov dword [ebp - 0x1584], 1
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x1584]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0xc4], eax
jge 0x47af66
mov dword [ebp - 0xeac], 1
jmp 0x47af6d
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0xc4]
cmp eax, 0x2c40
jle 0x47af98
mov dword [ebp - 0x18f4], 1
jmp 0x47af9f
and dword [ebp - 0x18f4], 0
mov eax, dword [ebp - 0x18f4]
mov dword [ebp - 0xeb4], eax
cmp dword [ebp - 0xeb4], 0
jne 0x47afc6
cmp dword [ebp - 0x458], 0
jne 0x47afc6
and dword [ebp - 0x158c], 0
jmp 0x47afd0
mov dword [ebp - 0x158c], 1
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x158c], eax
jge 0x47aff0
cmp dword [ebp - 0x740], 0
jne 0x47aff0
and dword [ebp - 0x1fd8], 0
jmp 0x47affa
mov dword [ebp - 0x1fd8], 1
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x2c7c], eax
cmp dword [ebp - 0xebc], 0xbf5e4d8d
jbe 0x47b024
cmp dword [ebp - 0xc4], 0
jne 0x47b024
and dword [ebp - 0x1aac], 0
jmp 0x47b02e
mov dword [ebp - 0x1aac], 1
mov eax, dword [ebp - 0x1aac]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x2c84], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x2c8c], eax
cmp dword [ebp - 0x740], 0xfc1c5751
je 0x47b06a
mov dword [ebp - 0xec4], 1
jmp 0x47b071
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0x490]
add eax, dword [ebp - 0xec4]
je 0x47b263
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xedc], 0xffffffff
cmp dword [ebp - 0xe4], 0
jne 0x47b24b
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0xe4], eax
jle 0x47b0be
mov dword [ebp - 0x1e4c], 1
jmp 0x47b0c5
and dword [ebp - 0x1e4c], 0
cmp dword [ebp - 0xe4], 0xce724d25
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xe4], eax
je 0x47b0e9
mov dword [ebp - 0x1594], 1
jmp 0x47b0f0
and dword [ebp - 0x1594], 0
mov eax, dword [ebp - 0x1594]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x2c94], eax
mov eax, 0x7924a04c
cmp eax, 0xfffffffd
jg 0x47b11e
mov dword [ebp - 0xecc], 1
jmp 0x47b125
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0xecc], eax
jl 0x47b145
cmp dword [ebp - 0xe4], 0
jne 0x47b145
and dword [ebp - 0x18fc], 0
jmp 0x47b14f
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x18fc], eax
jge 0x47b169
mov dword [ebp - 0x1fe0], 1
jmp 0x47b170
and dword [ebp - 0x1fe0], 0
mov eax, 0xd97b6eb5
test eax, eax
jne 0x47b18b
cmp dword [ebp - 0xe4], 0
jne 0x47b18b
and dword [ebp - 0xed4], 0
jmp 0x47b195
mov dword [ebp - 0xed4], 1
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0xed4], eax
jg 0x47b1af
mov dword [ebp - 0x1e54], 1
jmp 0x47b1b6
and dword [ebp - 0x1e54], 0
mov eax, dword [ebp - 0x410]
sub eax, 0xf72d
cmp eax, dword [ebp - 0xe4]
je 0x47b1d5
mov dword [ebp - 0x159c], 1
jmp 0x47b1dc
and dword [ebp - 0x159c], 0
cmp dword [ebp - 0xedc], 0
je 0x47b1ee
cmp dword [ebp - 0x410], 0
jne 0x47b1f5
cmp dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2c9c], eax
mov eax, dword [ebp - 0xedc]
mov dword [ebp - 0x2ca4], eax
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x490], eax
jg 0x47b227
mov dword [ebp - 0x1bf4], 1
jmp 0x47b22e
and dword [ebp - 0x1bf4], 0
mov eax, dword [ebp - 0x1fe8]
imul eax, dword [ebp - 0x1bf4]
test eax, eax
jne 0x47b24b
mov dword [ebp - 0xee4], 1
jmp 0x47b252
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0xee4]
mov dword [ebp - 0x458], eax
jmp 0x47b3fe
mov dword [ebp - 0x6b0], 0xb776
mov dword [ebp - 0x15a4], 0x43c7d870
mov dword [ebp - 0xeec], 0
mov dword [ebp - 0x2cac], 0x30cb0470
push 3
lea ecx, [ebp - 0x2da4]
call fcn.00433ba3
mov dword [ebp - 0x2cb4], 0
push 1
lea ecx, [ebp - 0x27c0]
call fcn.00433ba3
mov dword [ebp - 0x140], 0
jmp 0x47b2c8
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x47b2ea
push dword [ebp - 0x140]
lea ecx, [ebp - 0x2da4]
call fcn.00433c91
mov dword [eax], 0xfffffff9
jmp 0x47b2bb
mov dword [ebp - 0x140], 0
jmp 0x47b303
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x47b325
push dword [ebp - 0x140]
lea ecx, [ebp - 0x27c0]
call fcn.00433c91
mov dword [eax], 0xa1d01971
jmp 0x47b2f6
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x15a4], eax
mov eax, dword [ebp - 0x15a4]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0xeec], eax
jle 0x47b357
mov dword [ebp - 0x1904], 1
jmp 0x47b35e
and dword [ebp - 0x1904], 0
mov eax, dword [ebp - 0x6b0]
cmp eax, dword [ebp - 0x1904]
jge 0x47b378
mov dword [ebp - 0x1e5c], 1
jmp 0x47b37f
and dword [ebp - 0x1e5c], 0
mov eax, dword [ebp - 0x490]
cmp dword [ebp - 0x418], eax
jle 0x47b399
mov dword [ebp - 0x1ff0], 1
jmp 0x47b3a0
and dword [ebp - 0x1ff0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x2cbc], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x2cc4], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x458], eax
push 0
lea ecx, [ebp - 0x27c0]
call fcn.00433c91
mov dword [ebp - 0xef4], eax
mov eax, dword [ebp - 0xef4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xef4]
mov dword [ecx], eax
lea ecx, [ebp - 0x27c0]
call fcn.00433c75
lea ecx, [ebp - 0x2da4]
call fcn.00433c75
mov dword [ebp - 0x1e64], 0xc28ee66d
mov dword [ebp - 0x1c8], 1
push 2
lea ecx, [ebp - 0xa04]
call fcn.00433ba3
push 3
lea ecx, [ebp - 0xa1c]
call fcn.00433ba3
mov dword [ebp - 0x420], 0xffff
mov dword [ebp - 0x1e84], 0
mov dword [ebp - 0x1c0], 0
jmp 0x47b459
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x47b478
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xa04]
call fcn.00433c91
and dword [eax], 0
jmp 0x47b44c
mov dword [ebp - 0x1c0], 0
jmp 0x47b491
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x47b4b3
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xa1c]
call fcn.00433c91
mov dword [eax], 0x5f1dbecc
jmp 0x47b484
push 0
lea ecx, [ebp - 0xa04]
call fcn.00433c91
mov dword [eax], 0x1c
jmp 0x47b4ec
push 0
lea ecx, [ebp - 0xa04]
call fcn.00433c91
mov dword [ebp - 0x15ac], eax
mov eax, dword [ebp - 0x15ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x15ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa04]
call fcn.00433c91
cmp dword [eax], 0xffffffff
jl 0x47ba63
mov dword [ebp - 0x228], 1
mov dword [ebp - 0xf04], 0
mov dword [ebp - 0x15bc], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x47b539
cmp dword [ebp - 0x228], 2
jg 0x47ba5e
mov dword [ebp - 0xb0], 9
mov dword [ebp - 0x1e7c], 9
mov dword [ebp - 0x2010], 0x5344ffa2
mov dword [ebp - 0x574], 0
jmp 0x47b57d
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 4
jge 0x47b599
mov eax, dword [ebp - 0x574]
mov dword [ebp + eax*4 - 0x305c], 0xaf066b7a
jmp 0x47b570
mov dword [ebp - 0xb0], 2
jmp 0x47b5b2
cmp dword [ebp - 0xb0], 0
jl 0x47b78b
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xa1c]
call fcn.00433c91
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x2ccc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x305c], 0xf78cc702
cmp dword [ebp - 0x228], 0xf78cc702
jne 0x47b605
mov dword [ebp - 0xefc], 1
jmp 0x47b60c
and dword [ebp - 0xefc], 0
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0xefc]
jne 0x47b626
mov dword [ebp - 0x420], 0
jmp 0x47b7a4
cmp dword [ebp - 0x420], 0xf
jge 0x47ba59
jmp 0x47b4c8
lea ecx, [ebp - 0xa1c]
call fcn.00433c75
lea ecx, [ebp - 0xa04]
call fcn.00433c75
mov dword [ebp - 0x194c], 0xcd66a075
mov dword [ebp - 0x9bc], 0xb4ffb871
mov dword [ebp - 0x2018], 0xbd085c9e
mov dword [ebp - 0x394], 0xfc4f27d2
or dword [ebp - 0x256c], 0xffffffff
or dword [ebp - 0x2568], 0xffffffff
or dword [ebp - 0x2564], 0xffffffff
or dword [ebp - 0x2560], 0xffffffff
lea ecx, [ebp - 0x8e9]
call fcn.00433ca0
push eax
lea eax, [ebp - 0x255c]
push eax
lea eax, [ebp - 0x256c]
push eax
lea ecx, [ebp - 0x31d8]
call fcn.00433ca3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1da0]
call fcn.00433c4f
mov dword [ebp - 0x888], 0xf9d44c03
mov dword [ebp - 0x1e8c], 0xf885bd52
mov byte [ebp - 0x250], 0
movzx eax, byte [ebp - 0x250]
test eax, eax
je 0x47bb2e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x2ce4], eax
mov eax, dword [ebp - 0x888]
dec eax
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x2018]
cmp dword [ebp - 0x888], eax
jle 0x47bb61
mov dword [ebp - 0x15dc], 1
jmp 0x47bb68
and dword [ebp - 0x15dc], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x2cec], eax
mov eax, dword [ebp - 0x9bc]
imul eax, dword [ebp - 0x394]
add eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0x1e8c]
jge 0x47bb9b
mov dword [ebp - 0xf4c], 1
jmp 0x47bba2
and dword [ebp - 0xf4c], 0
push 1
lea ecx, [ebp - 0x1da0]
call fcn.00433c91
mov eax, dword [eax]
cmp eax, dword [ebp - 0xf4c]
jle 0x47bbc5
mov dword [ebp - 0x191c], 1
jmp 0x47bbcc
and dword [ebp - 0x191c], 0
push 1
lea ecx, [ebp - 0x1da0]
call fcn.00433c91
mov eax, dword [eax]
cmp eax, dword [ebp - 0x191c]
jle 0x47bbef
mov dword [ebp - 0xf54], 1
jmp 0x47bbf6
and dword [ebp - 0xf54], 0
mov eax, dword [ebp - 0xf54]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x15dc], eax
jge 0x47bc1c
mov dword [ebp - 0x2020], 1
jmp 0x47bc23
and dword [ebp - 0x2020], 0
push 1
lea ecx, [ebp - 0x1da0]
call fcn.00433c91
cmp dword [ebp - 0x394], 0x10a1
jge 0x47bc48
mov dword [ebp - 0x1e94], 1
jmp 0x47bc4f
and dword [ebp - 0x1e94], 0
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0x2cf4], eax
push 1
lea ecx, [ebp - 0x1da0]
call fcn.00433c91
mov esi, eax
push 1
lea ecx, [ebp - 0x1da0]
call fcn.00433c91
mov ecx, dword [esi]
mov dword [eax], ecx
lea ecx, [ebp - 0x1da0]
call fcn.00433c75
mov dword [ebp - 0x57c], 0
jmp 0x47bc9f