Function at 0x46f78e
Capabilities:
Check os version
Create process on windows
Enumerate gui resources
Get common file path
Get file attributes
Get memory capacity
Identify system language via api
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3794
call fcn.004a5c60
push esi
mov dword [ebp - 0x2264], 0x76b0f738
push 3
lea ecx, [ebp - 0x2494]
call fcn.0043324a
mov dword [ebp - 0x1e08], 0xedb5
push 2
lea ecx, [ebp - 0x2a2c]
call fcn.0043324a
mov dword [ebp - 0x924], 0x752f67d5
mov dword [ebp - 0x1e2c], 0x5466
mov dword [ebp - 0x1e34], 0xffff
mov dword [ebp - 0x2cfc], 0x1f9531de
mov dword [ebp - 0x1f4], 0
jmp 0x46f80b
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x46f82a
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x2494]
call fcn.00433338
and dword [eax], 0
jmp 0x46f7fe
mov dword [ebp - 0x1f4], 0
jmp 0x46f843
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x46f865
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x2a2c]
call fcn.00433338
mov dword [eax], 2
jmp 0x46f836
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x924], eax
push 0
lea ecx, [ebp - 0x2494]
call fcn.00433338
mov dword [eax], 0xb0cf
push 2
lea ecx, [ebp - 0x2494]
call fcn.00433338
mov ecx, dword [ebp - 0x1e2c]
cmp dword [eax], ecx
jne 0x46f8a8
mov dword [ebp - 0xf68], 1
jmp 0x46f8af
and dword [ebp - 0xf68], 0
push 0
lea ecx, [ebp - 0x2494]
call fcn.00433338
mov eax, dword [eax]
cmp eax, dword [ebp - 0xf68]
jg 0x46f8d2
mov dword [ebp - 0x1df0], 1
jmp 0x46f8d9
and dword [ebp - 0x1df0], 0
cmp dword [ebp - 0x1df0], 1
jne 0x46f8ee
mov dword [ebp - 0x1df8], 1
jmp 0x46f8f5
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x1e08]
cmp dword [ebp - 0x1df8], eax
jle 0x46f90f
mov dword [ebp - 0x1e00], 1
jmp 0x46f916
and dword [ebp - 0x1e00], 0
push 0
lea ecx, [ebp - 0x2a2c]
call fcn.00433338
mov ecx, dword [ebp - 0x1e00]
cmp ecx, dword [eax]
jne 0x46f939
mov dword [ebp - 0x2018], 1
jmp 0x46f940
and dword [ebp - 0x2018], 0
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x46f95c
cmp dword [ebp - 0x1e08], 0
je 0x46f95c
mov dword [ebp - 0x1e1c], 1
jmp 0x46f963
and dword [ebp - 0x1e1c], 0
cmp dword [ebp - 0x1e1c], 0xffff
je 0x46f97f
push 5
pop eax
test eax, eax
jne 0x46f97f
and dword [ebp - 0x1e24], 0
jmp 0x46f989
mov dword [ebp - 0x1e24], 1
cmp dword [ebp - 0x1e24], 0
jle 0x46f99e
mov dword [ebp - 0x225c], 1
jmp 0x46f9a5
and dword [ebp - 0x225c], 0
mov eax, dword [ebp - 0x1e2c]
mov dword [ebp - 0x2fdc], eax
mov eax, dword [ebp - 0x1e34]
cmp dword [ebp - 0x1e34], eax
mov eax, dword [ebp - 0x924]
mov dword [ebp - 0x2264], eax
lea ecx, [ebp - 0x2a2c]
call fcn.0043331c
lea ecx, [ebp - 0x2494]
call fcn.0043331c
mov dword [ebp - 0x838], 0xdf99ff60
mov dword [ebp - 0x32f4], 0
mov dword [ebp - 0x5f8], 0
jmp 0x46fa0c
mov eax, dword [ebp - 0x5f8]
inc eax
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 2
jge 0x46fa28
mov eax, dword [ebp - 0x5f8]
mov dword [ebp + eax*4 - 0x2c44], 0xfffffff9
jmp 0x46f9ff
mov dword [ebp - 0x838], 0
jmp 0x46fa41
mov eax, dword [ebp - 0x838]
dec eax
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0xffffffe3
jg 0x46faba
mov dword [ebp - 0xac4], 0x4f09
mov dword [ebp - 0x1e3c], 0x73292c5e
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0x1e3c], eax
mov eax, dword [ebp - 0x1e3c]
mov dword [ebp - 0x226c], eax
mov eax, dword [ebp - 0xac4]
inc eax
mov dword [ebp - 0xac4], eax
cmp dword [ebp - 0x226c], 0x4446
jne 0x46fa9b
mov dword [ebp - 0x1e44], 1
jmp 0x46faa2
and dword [ebp - 0x1e44], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e44]
mov dword [ebp + eax - 0x2c44], ecx
jmp 0x46fa34
mov dword [ebp - 0x4f0], 0xfffffff6
mov dword [ebp - 0x1e54], 0xf95751cf
mov dword [ebp - 0x92c], 0xffffffff
mov dword [ebp - 0x1e7c], 0xffffffff
mov dword [ebp - 0x2274], 0
push 1
lea ecx, [ebp - 0x2930]
call fcn.0043324a
mov dword [ebp - 0x2fe4], 8
mov dword [ebp - 0x608], 0
jmp 0x46fb1c
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 1
jge 0x46fb3b
push dword [ebp - 0x608]
lea ecx, [ebp - 0x2930]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x46fb0f
cmp dword [ebp - 0x4f0], 0
je 0x46fb50
mov dword [ebp - 0x1e4c], 1
jmp 0x46fb57
and dword [ebp - 0x1e4c], 0
mov eax, dword [ebp - 0x4f0]
imul eax, dword [ebp - 0x1e4c]
test eax, eax
je 0x46fb7d
cmp dword [ebp - 0x92c], 0
je 0x46fb7d
mov dword [ebp - 0x1e5c], 1
jmp 0x46fb84
and dword [ebp - 0x1e5c], 0
mov dword [ebp - 0x1e54], 0x1fa147b8
mov eax, dword [ebp - 0x4f0]
sub eax, dword [ebp - 0x1e54]
cmp eax, dword [ebp - 0x1e5c]
jg 0x46fbae
mov dword [ebp - 0x1e64], 1
jmp 0x46fbb5
and dword [ebp - 0x1e64], 0
cmp dword [ebp - 0x1e64], 0xfffffff7
je 0x46fbca
mov dword [ebp - 0x1e6c], 1
jmp 0x46fbd1
and dword [ebp - 0x1e6c], 0
cmp dword [ebp - 0x1e6c], 9
jle 0x46fbe6
mov dword [ebp - 0x1e74], 1
jmp 0x46fbed
and dword [ebp - 0x1e74], 0
mov eax, dword [ebp - 0x1e74]
neg eax
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
imul eax, dword [ebp - 0x92c]
mov dword [ebp - 0x1e7c], eax
mov eax, dword [ebp - 0x1e7c]
mov dword [ebp - 0x3548], eax
mov eax, dword [ebp - 0x2274]
mov dword [ebp - 0x2fec], eax
mov esi, dword [ebp - 0x92c]
push 0
lea ecx, [ebp - 0x2930]
call fcn.00433338
mov dword [eax], esi
lea ecx, [ebp - 0x2930]
call fcn.0043331c
mov dword [ebp - 0x23c4], 0x76b0f738
mov dword [ebp - 0x610], 0xffffffff
mov dword [ebp - 0x404], 0x7207
mov byte [ebp - 0x3f2], 0
movzx eax, byte [ebp - 0x3f2]
test eax, eax
je 0x46fc81
push 0x976
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov eax, dword [ebp - 0x610]
sub eax, 7
cmp eax, dword [ebp - 0x610]
jne 0x46fc9e
mov dword [ebp - 0x1e84], 1
jmp 0x46fca5
and dword [ebp - 0x1e84], 0
cmp dword [ebp - 0x610], 0x4562
jge 0x46fcbd
mov dword [ebp - 0x1e8c], 1
jmp 0x46fcc4
and dword [ebp - 0x1e8c], 0
mov eax, dword [ebp - 0x1e84]
cmp eax, dword [ebp - 0x1e8c]
jne 0x46fce7
mov eax, 0x7dcd
test eax, eax
je 0x46fce7
mov dword [ebp - 0x1e94], 1
jmp 0x46fcee
and dword [ebp - 0x1e94], 0
cmp dword [ebp - 0x1e94], 0xffffffff
jne 0x46fda9
cmp dword [ebp - 0x404], 0
je 0x46fda9
mov dword [ebp - 0x227c], 0xb61b
push 2
lea ecx, [ebp - 0x2a44]
call fcn.0043324a
mov dword [ebp - 0x780], 0
jmp 0x46fd38
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 2
jge 0x46fd5a
push dword [ebp - 0x780]
lea ecx, [ebp - 0x2a44]
call fcn.00433338
mov dword [eax], 0xe3e7631
jmp 0x46fd2b
mov dword [ebp - 0x227c], 0x6a1c17c7
mov dword [ebp - 0x404], 0
jmp 0x46fd7d
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 2
jge 0x46fd9c
push dword [ebp - 0x404]
lea ecx, [ebp - 0x2a44]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x46fd70
lea ecx, [ebp - 0x2a44]
call fcn.0043331c
jmp 0x46fe01
mov dword [ebp - 0x2284], 0xfffffff8
mov byte [ebp - 0x288], 0
movzx eax, byte [ebp - 0x288]
test eax, eax
je 0x46fdd6
push 0
push 0x1562
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
cmp dword [ebp - 0x2284], 0xc07c2076
je 0x46fdee
mov dword [ebp - 0x1e9c], 1
jmp 0x46fdf5
and dword [ebp - 0x1e9c], 0
mov eax, dword [ebp - 0x1e9c]
mov dword [ebp - 0x610], eax
push 3
lea ecx, [ebp - 0x24c4]
call fcn.0043324a
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x898], 0
jmp 0x46fe31
mov eax, dword [ebp - 0x898]
inc eax
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 3
jge 0x46fe4d
mov eax, dword [ebp - 0x898]
mov dword [ebp + eax*4 - 0x36e4], 0xfff6
jmp 0x46fe24
mov dword [ebp - 0x24c], 0
jmp 0x46fe66
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jg 0x46fe90
mov byte [ebp - 0x28a], 0
movzx eax, byte [ebp - 0x28a]
test eax, eax
je 0x46fe8e
push 0x1b6a
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x46fe59
mov dword [ebp - 0x24c], 0x11
jmp 0x46fea9
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
jg 0x46fece
mov byte [ebp - 0x28c], 0
movzx eax, byte [ebp - 0x28c]
test eax, eax
je 0x46fecc
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x46fe9c
mov dword [ebp - 0xc40], 0xedb5
push 2
lea ecx, [ebp - 0x2bc4]
call fcn.0043324a
mov dword [ebp - 0x590], 0x57976326
mov dword [ebp - 0x618], 0
jmp 0x46ff08
mov eax, dword [ebp - 0x618]
inc eax
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x618], 2
jge 0x46ff27
push dword [ebp - 0x618]
lea ecx, [ebp - 0x2bc4]
call fcn.00433338
and dword [eax], 0
jmp 0x46fefb
mov dword [ebp - 0x590], 1
jmp 0x46ff40
mov eax, dword [ebp - 0x590]
dec eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 0
jl 0x46ff63
push dword [ebp - 0x590]
lea ecx, [ebp - 0x2bc4]
call fcn.00433338
cmp dword [eax], 0
je 0x46ff61
jmp 0x46ff63
jmp 0x46ff33
lea ecx, [ebp - 0x2bc4]
call fcn.0043331c
push 2
lea ecx, [ebp - 0x2b7c]
call fcn.0043324a
mov dword [ebp - 0x3304], 2
mov dword [ebp - 0x2ff4], 1
mov dword [ebp - 0x3470], 0x1d925b0e
mov dword [ebp - 0x2ffc], 0xffffffff
mov dword [ebp - 0x3314], 0xffffffff
mov dword [ebp - 0x3004], 0xcf2e5664
mov dword [ebp - 0x34f8], 0xba07e4fc
mov dword [ebp - 0x300c], 8
mov dword [ebp - 0x3324], 0xfffffffd
push 1
lea ecx, [ebp - 0x30f0]
call fcn.0043324a
mov dword [ebp - 0x3014], 9
mov dword [ebp - 0x1ea4], 1
mov dword [ebp - 0x3478], 0xddca
mov dword [ebp - 0x1efc], 1
mov dword [ebp - 0x16c], 0
jmp 0x470023
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x47003f
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x3658], 0xfffffff8
jmp 0x470016
mov dword [ebp - 0x16c], 0
jmp 0x470058
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x47007a
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x30f0]
call fcn.00433338
mov dword [eax], 0xfffffff7
jmp 0x47004b
mov eax, dword [ebp - 0x1ea4]
dec eax
mov dword [ebp - 0x1ea4], eax
mov eax, dword [ebp - 0x1efc]
dec eax
mov dword [ebp - 0x1efc], eax
lea ecx, [ebp - 0x30f0]
call fcn.0043331c
mov dword [ebp - 0xa94], 0x752f67d5
push 4
lea ecx, [ebp - 0x2a5c]
call fcn.0043324a
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x228c], 0xfffffffe
mov dword [ebp - 0x301c], 0xdc99cdf9
mov dword [ebp - 0x3334], 0xbe856dfc
mov dword [ebp - 0x3024], 0
push 3
lea ecx, [ebp - 0x3110]
call fcn.0043324a
mov dword [ebp - 0x2c18], 1
mov dword [ebp - 0x5c], 0
jmp 0x47010f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x47012b
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2a5c]
call fcn.00433338
mov dword [eax], 0xfffffffc
jmp 0x470108
mov dword [ebp - 0x5c], 0
jmp 0x47013b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x470151
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2c20], 0
jmp 0x470134
mov dword [ebp - 0x5c], 0
jmp 0x470161
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x47017a
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x3110]
call fcn.00433338
and dword [eax], 0
jmp 0x47015a
mov dword [ebp - 0x21c], 0
jmp 0x470193
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jg 0x4701b6
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x2a5c]
call fcn.00433338
cmp dword [eax], 0
je 0x4701b4
jmp 0x4701b6
jmp 0x470186
mov dword [ebp - 0x21c], 0
jmp 0x4701cf
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x1a
jle 0x4703e1
mov dword [ebp - 0x620], 0x74b666a7
mov dword [ebp - 0x2c28], 0xeb4c8f0d
mov dword [ebp - 0x2c30], 0xfffffffe
mov dword [ebp - 0x2c38], 0x4dcc80fc
mov dword [ebp - 0x2cf0], 0
mov dword [ebp - 0x2cf8], 0x5ac3d6c1
mov dword [ebp - 0x1aac], 0xffff
mov dword [ebp - 0x788], 0
jmp 0x47023b
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 4
jge 0x470257
mov eax, dword [ebp - 0x788]
mov dword [ebp + eax*4 - 0x3758], 3
jmp 0x47022e
mov dword [ebp - 0x620], 0
jmp 0x470270
mov eax, dword [ebp - 0x620]
inc eax
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0x18
jle 0x4703dc
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x2d00], 0x2dd78f4f
mov dword [ebp - 0x2d08], 0xbefcdf1
mov dword [ebp - 0x2d10], 0xfffffffa
mov dword [ebp - 0x2d18], 0xde450bb
push 2
lea ecx, [ebp - 0x3100]
call fcn.0043324a
and dword [ebp - 0x27f8], 0
and dword [ebp - 0x27f4], 0
and dword [ebp - 0x27f0], 0
and dword [ebp - 0x27ec], 0
lea ecx, [ebp - 0xaf5]
call fcn.00433347
push eax
lea eax, [ebp - 0x27e8]
push eax
lea eax, [ebp - 0x27f8]
push eax
lea ecx, [ebp - 0x3648]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x35a0]
call fcn.004332f6
mov dword [ebp - 0x840], 0
jmp 0x470326
mov eax, dword [ebp - 0x840]
inc eax
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 2
jge 0x470348
push dword [ebp - 0x840]
lea ecx, [ebp - 0x3100]
call fcn.00433338
mov dword [eax], 0x4d07ddbf
jmp 0x470319
mov dword [ebp - 0x628], 0
jmp 0x470361
mov eax, dword [ebp - 0x628]
dec eax
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0xfffffffa
je 0x4703b4
mov dword [ebp - 0x790], 0
jmp 0x470383
mov eax, dword [ebp - 0x790]
inc eax
mov dword [ebp - 0x790], eax
cmp dword [ebp - 0x790], 3
jge 0x47039f
mov eax, dword [ebp - 0x790]
mov dword [ebp + eax*4 - 0x3570], 0
jmp 0x470376
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3570]
mov dword [ebp - 0x228c], eax
jmp 0x470354
mov eax, dword [ebp - 0x1aac]
dec eax
mov dword [ebp - 0x1aac], eax
lea ecx, [ebp - 0x35a0]
call fcn.0043331c
lea ecx, [ebp - 0x3100]
call fcn.0043331c
jmp 0x470263
jmp 0x4701c2
lea ecx, [ebp - 0x3110]
call fcn.0043331c
lea ecx, [ebp - 0x2a5c]
call fcn.0043331c
mov dword [ebp - 0x1bf8], 0x5466
mov dword [ebp - 0x588], 0x399841b3
mov dword [ebp - 0x1b30], 1
mov dword [ebp - 0x2294], 0xffffffff
mov dword [ebp - 0x588], 0
jmp 0x470438
mov eax, dword [ebp - 0x588]
dec eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 0xffffffe8
je 0x470506
mov dword [ebp - 0x630], 9
mov dword [ebp - 0xb90], 9
mov dword [ebp - 0x1b38], 1
mov dword [ebp - 0xb98], 0x1747
mov dword [ebp - 0x1b30], 6
mov eax, dword [ebp - 0x1b30]
sub eax, dword [ebp - 0x630]
cmp eax, 7
jb 0x470494
mov dword [ebp - 0xb88], 1
jmp 0x47049b
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0x1b38], eax
mov eax, dword [ebp - 0x1b38]
cmp dword [ebp - 0xb90], eax
jle 0x4704cd
mov dword [ebp - 0x1b40], 1
jmp 0x4704d4
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0x630]
sub ecx, dword [ebp - 0x1b40]
add ecx, dword [ebp - 0x588]
imul eax, ecx
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0x2294], eax
jmp 0x47042b
mov dword [ebp - 0xc50], 0xffff
push 3
lea ecx, [ebp - 0xb24]
call fcn.0043324a
mov dword [ebp - 0xba8], 0xba8b35ed
mov dword [ebp - 0x22a4], 2
mov dword [ebp - 0x8c8], 0
jmp 0x47054a
mov eax, dword [ebp - 0x8c8]
inc eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 3
jge 0x47056c
push dword [ebp - 0x8c8]
lea ecx, [ebp - 0xb24]
call fcn.00433338
mov dword [eax], 0x62d5e48d
jmp 0x47053d
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
mov dword [eax], 0x1d
jmp 0x4705a5
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
mov dword [ebp - 0x1b48], eax
mov eax, dword [ebp - 0x1b48]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1b48]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
cmp dword [eax], 6
jg 0x4707d5
mov dword [ebp - 0x2898], 7
mov dword [ebp - 0x2894], 7
mov dword [ebp - 0x2890], 7
mov dword [ebp - 0x288c], 7
lea ecx, [ebp - 0x911]
call fcn.00433347
push eax
lea eax, [ebp - 0x2888]
push eax
lea eax, [ebp - 0x2898]
push eax
lea ecx, [ebp - 0x35d8]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2b1c]
call fcn.004332f6
mov dword [ebp - 0xba0], 0
mov dword [ebp - 0x229c], 0xfffffff8
mov dword [ebp - 0x2384], 0xfffffffb
push 3
lea ecx, [ebp - 0x2b1c]
call fcn.00433338
mov eax, dword [eax]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0x2d20], eax
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
cmp dword [ebp - 0x229c], 0
je 0x470682
cmp dword [ebp - 0x22a4], 0
je 0x470682
mov dword [ebp - 0x1b50], 1
jmp 0x470689
and dword [ebp - 0x1b50], 0
mov dword [ebp - 0xba8], 0x4e76ab2a
mov eax, 0x59c4
sub eax, dword [ebp - 0x1b50]
cmp dword [ebp - 0xba8], eax
jle 0x4706b2
mov dword [ebp - 0x1b58], 1
jmp 0x4706b9
and dword [ebp - 0x1b58], 0
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1b58]
jl 0x4706dc
mov dword [ebp - 0xbb0], 1
jmp 0x4706e3
and dword [ebp - 0xbb0], 0
cmp dword [ebp - 0xbb0], 0x9523
jge 0x470701
push 0
lea ecx, [ebp - 0xb24]
call fcn.00433338
cmp dword [eax], 0
jne 0x470711
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x470711
and dword [ebp - 0x1b60], 0
jmp 0x47071b
mov dword [ebp - 0x1b60], 1
cmp dword [ebp - 0x1b60], 0x32e26595
jge 0x470733
mov dword [ebp - 0xbb8], 1
jmp 0x47073a
and dword [ebp - 0xbb8], 0
cmp dword [ebp - 0xbb8], 0
jg 0x470753
xor eax, eax
je 0x470753
mov dword [ebp - 0x1b68], 1
jmp 0x47075a
and dword [ebp - 0x1b68], 0
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
mov ecx, dword [ebp - 0x1b68]
cmp ecx, dword [eax]
je 0x47077d
mov dword [ebp - 0x22ac], 1
jmp 0x470784
and dword [ebp - 0x22ac], 0
push 3
lea ecx, [ebp - 0x2b1c]
call fcn.00433338
push 1
lea ecx, [ebp - 0xb24]
call fcn.00433338
mov eax, dword [eax]
mov dword [ebp - 0x2384], eax
mov byte [ebp - 0x28e], 0
movzx eax, byte [ebp - 0x28e]
test eax, eax
je 0x4707c5
push 0
push 0x124a
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
lea ecx, [ebp - 0x2b1c]
call fcn.0043331c
jmp 0x470581
lea ecx, [ebp - 0xb24]
call fcn.0043331c
mov dword [ebp - 0x2d28], 0x1f9531de
mov dword [ebp - 0x174], 0
jmp 0x470803
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x47081f
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x35b8], 0xfffffffd
jmp 0x4707f6
mov dword [ebp - 0x174], 0
jmp 0x470838
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x470854
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x1e14], 7
jmp 0x47082b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e14], 0
jmp 0x470882
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e14]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1e14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e14], 3
jge 0x4708ac
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e14]
mov dword [ebp + eax*4 - 0x35b8], 1
jmp 0x470867
push 3
lea ecx, [ebp - 0xb54]
call fcn.0043324a
mov dword [ebp - 0x138], 0x6aabecba
push 2
lea ecx, [ebp - 0x2a74]
call fcn.0043324a
mov dword [ebp - 0x238c], 0x4e7ccce1
mov dword [ebp - 0x1fc], 0
jmp 0x4708f3
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x470915
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xb54]
call fcn.00433338
mov dword [eax], 0x313dd33a
jmp 0x4708e6
mov dword [ebp - 0x1fc], 0
jmp 0x47092e
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x470950
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x2a74]
call fcn.00433338
mov dword [eax], 0x77045b3
jmp 0x470921
mov dword [ebp - 0x138], 0
jmp 0x470969
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jg 0x470c35
mov dword [ebp - 0x1b88], 1
mov dword [ebp - 0xbc8], 0xf446cd5f
mov dword [ebp - 0x2820], 7
mov dword [ebp - 0x281c], 7
mov dword [ebp - 0x2818], 7
mov dword [ebp - 0x2814], 7
lea ecx, [ebp - 0x919]
call fcn.00433347
push eax
lea eax, [ebp - 0x2810]
push eax
lea eax, [ebp - 0x2820]
push eax
lea ecx, [ebp - 0x3668]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x24a4]
call fcn.004332f6
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb54]
call fcn.00433338
cmp dword [eax], 0xb241
jg 0x470a0c
mov dword [ebp - 0xbc0], 1
jmp 0x470a13
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0xbc0], eax
je 0x470a3c
push 1
lea ecx, [ebp - 0xb54]
call fcn.00433338
cmp dword [eax], 0
jne 0x470a3c
and dword [ebp - 0x1b70], 0
jmp 0x470a46
mov dword [ebp - 0x1b70], 1
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb54]
call fcn.00433338
mov ecx, dword [ebp - 0x1b70]
cmp ecx, dword [eax]
je 0x470a6d
mov dword [ebp - 0xa24], 1
jmp 0x470a74
and dword [ebp - 0xa24], 0
push 0
lea ecx, [ebp - 0x2a74]
call fcn.00433338
mov ecx, dword [ebp - 0xa24]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xbc8], eax
mov esi, dword [ebp - 0xbc8]
push 0
lea ecx, [ebp - 0xb54]
call fcn.00433338
cmp esi, dword [eax]
jle 0x470ab8
mov dword [ebp - 0x1b78], 1
jmp 0x470abf
and dword [ebp - 0x1b78], 0
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb54]
call fcn.00433338
mov esi, eax
push 0
lea ecx, [ebp - 0x24a4]
call fcn.00433338
mov ecx, dword [ebp - 0x1b78]
add ecx, dword [eax]
cmp dword [esi], ecx
je 0x470af7
mov dword [ebp - 0xbd0], 1
jmp 0x470afe
and dword [ebp - 0xbd0], 0
xor eax, eax
sub eax, dword [ebp - 0xbd0]
jne 0x470b1a
mov eax, 0xffff
test eax, eax
jne 0x470b1a
and dword [ebp - 0x1b80], 0
jmp 0x470b24
mov dword [ebp - 0x1b80], 1
mov esi, dword [ebp - 0x138]
sub esi, dword [ebp - 0x1b80]
push 1
lea ecx, [ebp - 0xb54]
call fcn.00433338
add esi, dword [eax]
cmp esi, 0xac25
jg 0x470b53
mov dword [ebp - 0xbd8], 1
jmp 0x470b5a
and dword [ebp - 0xbd8], 0
push 1
lea ecx, [ebp - 0x24a4]
call fcn.00433338
mov ecx, dword [ebp - 0xbd8]
cmp ecx, dword [eax]
je 0x470b7d
mov dword [ebp - 0xbe0], 1
jmp 0x470b84
and dword [ebp - 0xbe0], 0
push dword [ebp - 0x138]
lea ecx, [ebp - 0xb54]
call fcn.00433338
mov eax, dword [eax]
mov dword [ebp - 0x1b88], eax
mov eax, dword [ebp - 0x1b88]
cmp eax, dword [ebp - 0xbe0]
jge 0x470bb7
mov dword [ebp - 0x1b90], 1
jmp 0x470bbe
and dword [ebp - 0x1b90], 0
push 1
lea ecx, [ebp - 0x24a4]
call fcn.00433338
mov ecx, dword [ebp - 0x1b90]
sub ecx, dword [eax]
je 0x470bf3
push 0
lea ecx, [ebp - 0x24a4]
call fcn.00433338
cmp dword [eax], 0
je 0x470bf3
mov dword [ebp - 0xbe8], 1
jmp 0x470bfa
and dword [ebp - 0xbe8], 0
cmp dword [ebp - 0xbe8], 0xba928f0b
je 0x470c12
mov dword [ebp - 0x1b98], 1
jmp 0x470c19
and dword [ebp - 0x1b98], 0
mov eax, dword [ebp - 0x1b98]
mov dword [ebp - 0x238c], eax
lea ecx, [ebp - 0x24a4]
call fcn.0043331c
jmp 0x47095c
lea ecx, [ebp - 0x2a74]
call fcn.0043331c
lea ecx, [ebp - 0xb54]
call fcn.0043331c
mov dword [ebp - 0x17c], 0
jmp 0x470c64
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x470c83
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x24c4]
call fcn.00433338
and dword [eax], 0
jmp 0x470c57
mov dword [ebp - 0x798], 1
mov dword [ebp - 0x638], 0
jmp 0x470ca6
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 1
jge 0x470cc2
mov eax, dword [ebp - 0x638]
mov dword [ebp + eax*4 - 0x2394], 0xfe01bd97
jmp 0x470c99
mov dword [ebp - 0x798], 0xfffffff3
jmp 0x470cdb
mov eax, dword [ebp - 0x798]
inc eax
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 1
je 0x470e10
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x4fc], 0
jmp 0x470d0b
mov eax, dword [ebp - 0x4fc]
dec eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0
jl 0x470df3
push 4
lea ecx, [ebp - 0x24b4]
call fcn.0043324a
mov dword [ebp - 0x640], 0
jmp 0x470d3e
mov eax, dword [ebp - 0x640]
inc eax
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 4
jge 0x470d60
push dword [ebp - 0x640]
lea ecx, [ebp - 0x24b4]
call fcn.00433338
mov dword [eax], 0xb5a5efa2
jmp 0x470d31
push 3
lea ecx, [ebp - 0x24b4]
call fcn.00433338
and dword [eax], 0
jmp 0x470d96
push 3
lea ecx, [ebp - 0x24b4]
call fcn.00433338
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0xbf0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbf0]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x24b4]
call fcn.00433338
cmp dword [eax], 0
jl 0x470de3
mov dword [ebp - 0x239c], 0xce55459e
mov eax, dword [ebp - 0x4fc]
cmp dword [ebp + eax*4 - 0x2394], 0xffffffff
ja 0x470dce
mov dword [ebp - 0x1ba0], 1
jmp 0x470dd5
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x1ba0]
mov dword [ebp - 0x239c], eax
jmp 0x470d72
lea ecx, [ebp - 0x24b4]
call fcn.0043331c
jmp 0x470cfe
mov byte [ebp - 0x290], 0
movzx eax, byte [ebp - 0x290]
test eax, eax
je 0x470e0b
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x470cce
mov dword [ebp - 0x17c], 0
jmp 0x470e29
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x470e4b
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x2b7c]
call fcn.00433338
mov dword [eax], 2
jmp 0x470e1c
mov dword [ebp - 0x55c], 0x477862fd
mov dword [ebp - 0x55c], 0
jmp 0x470e6e
mov eax, dword [ebp - 0x55c]
dec eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0xffffffe7
jle 0x470eb3
cmp dword [ebp - 0x55c], 0
je 0x470e82
jmp 0x470eb3
mov byte [ebp - 0x292], 0
movzx eax, byte [ebp - 0x292]
test eax, eax
je 0x470eb1
push 0
push 0x820
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
jmp 0x470e61
mov eax, dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa94], eax
push 3
lea ecx, [ebp - 0x904]
call fcn.0043324a
mov dword [ebp - 0x3c], 0xfffffffe
mov dword [ebp - 0x648], 0x1d4595a2
mov dword [ebp - 0x23ac], 8
mov dword [ebp - 0x848], 0
jmp 0x470f01
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 3
jge 0x470f23
push dword [ebp - 0x848]
lea ecx, [ebp - 0x904]
call fcn.00433338
mov dword [eax], 0xdc85f70a
jmp 0x470ef4
mov dword [ebp - 0x3c], 2
jmp 0x470f33
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x471202
mov dword [ebp - 0x23a4], 0xd402da3c
mov dword [ebp - 0x934], 0xb15a
mov dword [ebp - 0x7a0], 0xfffffffa
mov dword [ebp - 0xc20], 4
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
cmp dword [eax], 0
je 0x470fcb
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
cmp dword [eax], 0
je 0x470fcb
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
cmp dword [eax], 0xfffffff7
jl 0x470fb8
mov dword [ebp - 0xbf8], 1
jmp 0x470fbf
and dword [ebp - 0xbf8], 0
cmp dword [ebp - 0xbf8], 0xfffc
jne 0x470fe6
push 0
lea ecx, [ebp - 0x904]
call fcn.00433338
cmp dword [eax], 0
jne 0x470fe6
and dword [ebp - 0x1ba8], 0
jmp 0x470ff0
mov dword [ebp - 0x1ba8], 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
mov ecx, dword [ebp - 0x1ba8]
cmp ecx, dword [eax]
jge 0x471027
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
cmp dword [eax], 0
je 0x471027
mov dword [ebp - 0xc00], 1
jmp 0x47102e
and dword [ebp - 0xc00], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
mov ecx, dword [ebp - 0x3c]
imul ecx, dword [ebp - 0xc00]
cmp dword [eax], ecx
jg 0x471056
mov dword [ebp - 0x1bb0], 1
jmp 0x47105d
and dword [ebp - 0x1bb0], 0
cmp dword [ebp - 0x1bb0], 0xffffffff
jl 0x471072
mov dword [ebp - 0xc08], 1
jmp 0x471079
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xc08]
mov dword [ebp - 0x23a4], eax
push 0xfffffffffffffffb
pop eax
cmp eax, 0xffffffff
jne 0x4710a6
cmp dword [ebp - 0x934], 0
je 0x4710a6
mov dword [ebp - 0x1bb8], 1
jmp 0x4710ad
and dword [ebp - 0x1bb8], 0
push 1
lea ecx, [ebp - 0x904]
call fcn.00433338
mov ecx, dword [ebp - 0x1bb8]
cmp ecx, dword [eax]
jne 0x4710d0
mov dword [ebp - 0xc10], 1
jmp 0x4710d7
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x934]
cmp dword [ebp - 0x7a0], eax
jg 0x4710fd
mov dword [ebp - 0x1bc0], 1
jmp 0x471104
and dword [ebp - 0x1bc0], 0
mov eax, dword [ebp - 0x1bc0]
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x648], 0xcbb4
mov eax, dword [ebp - 0x648]
sub eax, 0x31219594
cmp eax, dword [ebp - 0x7a0]
jle 0x47113f
mov eax, 0x20b2
test eax, eax
jne 0x47113f
and dword [ebp - 0xc18], 0
jmp 0x471149
mov dword [ebp - 0xc18], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xc18], eax
jne 0x471160
mov dword [ebp - 0x1bc8], 1
jmp 0x471167
and dword [ebp - 0x1bc8], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x904]
call fcn.00433338
mov ecx, dword [ebp - 0x1bc8]
cmp ecx, dword [eax]
jge 0x471186
cmp dword [ebp - 0x648], 0
mov dword [ebp - 0xc20], 1
mov eax, dword [ebp - 0x934]
cmp dword [ebp - 0xc20], eax
jle 0x4711aa
mov dword [ebp - 0x1bd0], 1
jmp 0x4711b1
and dword [ebp - 0x1bd0], 0
cmp dword [ebp - 0x1bd0], 0x1cae
je 0x4711c9
mov dword [ebp - 0xc28], 1
jmp 0x4711d0
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x23ac]
cmp dword [ebp - 0xc28], eax
jl 0x4711ea
mov dword [ebp - 0x1bd8], 1
jmp 0x4711f1
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0x1bd8]
mov dword [ebp - 0x7a0], eax
jmp 0x470f2c
lea ecx, [ebp - 0x904]
call fcn.0043331c
push 0
lea ecx, [ebp - 0x24c4]
call fcn.00433338
mov dword [eax], 0xb0cf
push 2
lea ecx, [ebp - 0x24c4]
call fcn.00433338
mov ecx, dword [ebp - 0x1bf8]
cmp dword [eax], ecx
jne 0x471243
mov dword [ebp - 0xc30], 1
jmp 0x47124a
and dword [ebp - 0xc30], 0
push 0
lea ecx, [ebp - 0x24c4]
call fcn.00433338
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc30]
jg 0x47126d
mov dword [ebp - 0x1be0], 1
jmp 0x471274
and dword [ebp - 0x1be0], 0
cmp dword [ebp - 0x1be0], 1
jne 0x471289
mov dword [ebp - 0xc38], 1
jmp 0x471290
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0xc40]
cmp dword [ebp - 0xc38], eax
jle 0x4712aa
mov dword [ebp - 0x1be8], 1
jmp 0x4712b1
and dword [ebp - 0x1be8], 0
push 0
lea ecx, [ebp - 0x2b7c]
call fcn.00433338
mov ecx, dword [ebp - 0x1be8]
cmp ecx, dword [eax]
jne 0x4712d4
mov dword [ebp - 0x23b4], 1
jmp 0x4712db
and dword [ebp - 0x23b4], 0
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x4712f7
cmp dword [ebp - 0xc40], 0
je 0x4712f7
mov dword [ebp - 0x1bf0], 1
jmp 0x4712fe
and dword [ebp - 0x1bf0], 0
cmp dword [ebp - 0x1bf0], 0xffff
je 0x47131a
push 5
pop eax
test eax, eax
jne 0x47131a
and dword [ebp - 0xc48], 0
jmp 0x471324
mov dword [ebp - 0xc48], 1
cmp dword [ebp - 0xc48], 0
jle 0x471339
mov dword [ebp - 0x23bc], 1
jmp 0x471340
and dword [ebp - 0x23bc], 0
mov eax, dword [ebp - 0x1bf8]
mov dword [ebp - 0x2d30], eax
mov eax, dword [ebp - 0xc50]
cmp dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0x23c4], eax
lea ecx, [ebp - 0x2b7c]
call fcn.0043331c
lea ecx, [ebp - 0x24c4]
call fcn.0043331c
xor ecx, ecx
call fcn.004335b5
push eax
call fcn.0048a443
pop ecx
mov dword [ebp - 0x23cc], 0x62fd41e5
mov dword [ebp - 0x2e8], 0
push 1
lea ecx, [ebp - 0x26ac]
call fcn.0043324a
mov dword [ebp - 0xaec], 0xa6c2e3a4
mov dword [ebp - 0x23d4], 0x8ca929ef
mov dword [ebp - 0x9c], 0
jmp 0x4713d6
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x4713f2
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x22b8], 0x98070ade
jmp 0x4713c9
mov dword [ebp - 0x9c], 0
jmp 0x47140b
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x471427
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x2768], 0x756a3367
jmp 0x4713fe
mov dword [ebp - 0x9c], 0
jmp 0x471440
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x471462
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x26ac]
call fcn.00433338
mov dword [eax], 7
jmp 0x471433
push 0
lea ecx, [ebp - 0x26ac]
call fcn.00433338
mov dword [ebp - 0x1c00], eax
mov eax, dword [ebp - 0x1c00]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c00]
mov dword [ecx], eax
mov dword [ebp - 0x2e8], 0
jmp 0x47149f
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0xfffffff2
jg 0x471a3a
mov dword [ebp - 0x28e8], 0xbefcdf1
mov dword [ebp - 0x28e4], 0xbefcdf1
mov dword [ebp - 0x28e0], 0xbefcdf1
mov dword [ebp - 0x28dc], 0xbefcdf1
lea ecx, [ebp - 0xa19]
call fcn.00433347
push eax
lea eax, [ebp - 0x28d8]
push eax
lea eax, [ebp - 0x28e8]
push eax
lea ecx, [ebp - 0x3678]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5b8]
call fcn.004332f6
mov dword [ebp - 0x34], 0xfc75
mov dword [ebp - 0x1f3c], 0xce3d978
mov dword [ebp - 0x1f38], 0xce3d978
mov dword [ebp - 0x1f34], 0xce3d978
mov dword [ebp - 0x1f30], 0xce3d978
push 2
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov ecx, dword [ebp - 0x2e8]
cmp dword [eax], ecx
jl 0x471564
mov eax, 0x3c27
test eax, eax
je 0x471564
mov dword [ebp - 0xc58], 1
jmp 0x47156b
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xc58], eax
jge 0x471582
mov dword [ebp - 0x93c], 1
jmp 0x471589
and dword [ebp - 0x93c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x93c]
mov dword [ebp + eax - 0x2768], ecx
cmp dword [ebp - 0x93c], 0x83800955
je 0x4715b4
mov dword [ebp - 0x1c08], 1
jmp 0x4715bb
and dword [ebp - 0x1c08], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22b8]
cmp eax, dword [ebp - 0x1c08]
jle 0x4715dc
mov dword [ebp - 0xc60], 1
jmp 0x4715e3
and dword [ebp - 0xc60], 0
push 2
lea ecx, [ebp - 0x5b8]
call fcn.00433338
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x22b8]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0xc60]
test ecx, ecx
jne 0x471617
mov dword [ebp - 0xa2c], 1
jmp 0x47161e
and dword [ebp - 0xa2c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa2c]
mov dword [ebp + eax - 0x1f3c], ecx
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0x2e8], 8
je 0x471672
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x47166d
push 0
push 0
push 0x1ec5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
jmp 0x4717e6
mov dword [ebp - 0x2848], 0x5ff7
mov dword [ebp - 0x2844], 0x5ff7
mov dword [ebp - 0x2840], 0x5ff7
mov dword [ebp - 0x283c], 0x5ff7
lea ecx, [ebp - 0xa8d]
call fcn.00433347
push eax
lea eax, [ebp - 0x2838]
push eax
lea eax, [ebp - 0x2848]
push eax
lea ecx, [ebp - 0x3688]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a8c]
call fcn.004332f6
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1f3c], 0
jne 0x4716f7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1f3c], 0
jne 0x4716f7
and dword [ebp - 0xc68], 0
jmp 0x471701
mov dword [ebp - 0xc68], 1
push 1
lea ecx, [ebp - 0x2a8c]
call fcn.00433338
push 1
lea ecx, [ebp - 0x2a8c]
call fcn.00433338
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f3c]
mov dword [ebp - 0x2d38], eax
mov eax, dword [ebp - 0x23cc]
sub eax, dword [ebp - 0x34]
jne 0x47174a
mov eax, 0xffff
test eax, eax
jne 0x47174a
and dword [ebp - 0x1c10], 0
jmp 0x471754
mov dword [ebp - 0x1c10], 1
push 0
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov eax, dword [eax]
sub eax, dword [ebp - 0x1c10]
jns 0x471777
mov dword [ebp - 0x1c18], 1
jmp 0x47177e
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0xc68]
cmp eax, dword [ebp - 0x1c18]
jl 0x471798
mov dword [ebp - 0xc70], 1
jmp 0x47179f
and dword [ebp - 0xc70], 0
push 0
lea ecx, [ebp - 0x26ac]
call fcn.00433338
mov ecx, dword [ebp - 0xc70]
cmp ecx, dword [eax]
jge 0x4717c2
mov dword [ebp - 0x1c20], 1
jmp 0x4717c9
and dword [ebp - 0x1c20], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c20]
mov dword [ebp + eax - 0x1f3c], ecx
lea ecx, [ebp - 0x2a8c]
call fcn.0043331c
mov dword [ebp - 0x34], 0
jmp 0x4717f6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x471a2a
mov dword [ebp - 0xc98], 9
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov esi, eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x47183a
mov dword [ebp - 0xc78], 1
jmp 0x471841
and dword [ebp - 0xc78], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov ecx, dword [ebp - 0xc78]
cmp ecx, dword [eax]
jle 0x471912
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x1f3c]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
cmp esi, dword [eax]
jne 0x471887
mov dword [ebp - 0x1c28], 1
jmp 0x47188e
and dword [ebp - 0x1c28], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov eax, dword [eax]
add eax, dword [ebp - 0x1c28]
mov dword [ebp - 0x944], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x944]
mov dword [ebp + eax - 0x1f3c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x944]
mov dword [ebp + eax - 0x2768], ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov esi, dword [ebp - 0x944]
add esi, dword [eax]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
imul esi, dword [eax]
mov dword [ebp - 0xaec], esi
cmp dword [ebp - 0xaec], 0
je 0x471912
mov dword [ebp - 0xc80], 1
jmp 0x471919
and dword [ebp - 0xc80], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x22b8]
cmp dword [ebp - 0xc80], eax
jl 0x47193a
mov dword [ebp - 0x1c30], 1
jmp 0x471941
and dword [ebp - 0x1c30], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov ecx, dword [ebp - 0x1c30]
cmp ecx, dword [eax]
jge 0x471965
mov dword [ebp - 0xc88], 1
jmp 0x47196c
and dword [ebp - 0xc88], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov ecx, dword [ebp - 0xc88]
cmp ecx, dword [eax]
jne 0x471990
mov dword [ebp - 0x1c38], 1
jmp 0x471997
and dword [ebp - 0x1c38], 0
push 0
lea ecx, [ebp - 0x5b8]
call fcn.00433338
mov ecx, dword [ebp - 0x1c38]
cmp ecx, dword [eax]
jg 0x4719ba
mov dword [ebp - 0xc90], 1
jmp 0x4719c1
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0xc90], eax
jg 0x4719db
mov dword [ebp - 0x1c40], 1
jmp 0x4719e2
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x1c40]
mov dword [ebp - 0xc98], eax
mov esi, dword [ebp - 0xc98]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5b8]
call fcn.00433338
cmp esi, dword [eax]
jl 0x471a12
mov dword [ebp - 0x1c48], 1
jmp 0x471a19
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x1c48]
mov dword [ebp - 0x23d4], eax
jmp 0x4717ef
lea ecx, [ebp - 0x5b8]
call fcn.0043331c
jmp 0x471492
lea ecx, [ebp - 0x26ac]
call fcn.0043331c
push 3
lea ecx, [ebp - 0x1fb4]
call fcn.0043324a
mov dword [ebp - 0x274], 0
mov dword [ebp - 0xcc8], 0x5f7a0d7c
mov dword [ebp - 0x2d40], 0xe3c1
mov dword [ebp - 0x2d48], 0x78be
mov dword [ebp - 0x2d50], 0x65bbd97
push 3
lea ecx, [ebp - 0x2b34]
call fcn.0043324a
mov dword [ebp - 0x23ec], 0
mov dword [ebp - 0x23c], 0
jmp 0x471ab4
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x471ad6
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x1fb4]
call fcn.00433338
mov dword [eax], 0xcff0
jmp 0x471aa7
mov dword [ebp - 0x23c], 0
jmp 0x471aef
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x471b0e
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x2b34]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x471ae2
mov dword [ebp - 0x274], 0
jmp 0x471b27
cmp dword [ebp - 0x274], 2
jg 0x471e78
mov dword [ebp - 0x1c90], 5
mov dword [ebp - 0x23e4], 0x4518073
mov dword [ebp - 0x650], 0
jmp 0x471b61
mov eax, dword [ebp - 0x650]
inc eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 2
jge 0x471b7d
mov eax, dword [ebp - 0x650]
mov dword [ebp + eax*4 - 0x5a4], 0xffffffff
jmp 0x471b54
push 0
lea ecx, [ebp - 0x1fb4]
call fcn.00433338
cmp dword [eax], 1
jne 0x471b9b
mov dword [ebp - 0xca0], 1
jmp 0x471ba2
and dword [ebp - 0xca0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0xca0], eax
jge 0x471bc3
mov dword [ebp - 0x1c50], 1
jmp 0x471bca
and dword [ebp - 0x1c50], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0x1c50], eax
jge 0x471beb
mov dword [ebp - 0x23dc], 1
jmp 0x471bf2
and dword [ebp - 0x23dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
mov dword [ebp - 0x2d58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a4], 0xb51f0ef2
jae 0x471c24
mov dword [ebp - 0xca8], 1
jmp 0x471c2b
and dword [ebp - 0xca8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0xca8], eax
jg 0x471c4c
mov dword [ebp - 0x1c58], 1
jmp 0x471c53
and dword [ebp - 0x1c58], 0
push 1
lea ecx, [ebp - 0x1fb4]
call fcn.00433338
mov ecx, dword [ebp - 0x1c58]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x274]
jge 0x471c7c
mov dword [ebp - 0xcb0], 1
jmp 0x471c83
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0xcb0], eax
jle 0x471c9d
mov dword [ebp - 0x1c60], 1
jmp 0x471ca4
and dword [ebp - 0x1c60], 0
mov eax, dword [ebp - 0x1c60]
sub eax, 5
je 0x471ccb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a4], 0
je 0x471ccb
mov dword [ebp - 0xcb8], 1
jmp 0x471cd2
and dword [ebp - 0xcb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0xcb8], eax
jl 0x471cf3
mov dword [ebp - 0x1c68], 1
jmp 0x471cfa
and dword [ebp - 0x1c68], 0
cmp dword [ebp - 0x1c68], 0xdc0f1fa6
je 0x471d12
mov dword [ebp - 0xcc0], 1
jmp 0x471d19
and dword [ebp - 0xcc0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
add eax, dword [ebp - 0xcc0]
cmp eax, 8
jle 0x471d3d
mov dword [ebp - 0x1c70], 1
jmp 0x471d44
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0x1c70]
mov dword [ebp - 0xcc8], eax
cmp dword [ebp - 0xcc8], 0x77d7
jl 0x471d68
mov dword [ebp - 0x1c78], 1
jmp 0x471d6f
and dword [ebp - 0x1c78], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x1c78], eax
je 0x471d89
mov dword [ebp - 0xcd0], 1
jmp 0x471d90
and dword [ebp - 0xcd0], 0
cmp dword [ebp - 0xcd0], 0xfffffff6
jae 0x471da5
mov dword [ebp - 0x1c80], 1
jmp 0x471dac
and dword [ebp - 0x1c80], 0
cmp dword [ebp - 0x1c80], 0xba8d
je 0x471dc4
mov dword [ebp - 0xcd8], 1
jmp 0x471dcb
and dword [ebp - 0xcd8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
cmp dword [ebp - 0xcd8], eax
jle 0x471dec
mov dword [ebp - 0x1c88], 1
jmp 0x471df3
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x1c88]
jle 0x471e0d
mov dword [ebp - 0xce0], 1
jmp 0x471e14
and dword [ebp - 0xce0], 0
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0x1c90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a4]
mov dword [ebp - 0x2d60], eax
mov eax, dword [ebp - 0x1c90]
mov dword [ebp - 0x2d68], eax
push 2
lea ecx, [ebp - 0x1fb4]
call fcn.00433338
cmp dword [eax], 0x711f64db
je 0x471e60
mov dword [ebp - 0xce8], 1
jmp 0x471e67
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x23e4], eax
jmp 0x471b1a
push 0
lea ecx, [ebp - 0x2b34]
call fcn.00433338
mov dword [eax], 1
push 5
pop esi
inc esi
push 1
lea ecx, [ebp - 0x1fb4]
call fcn.00433338
cmp esi, dword [eax]
jne 0x471eac
mov dword [ebp - 0x1c98], 1
jmp 0x471eb3
and dword [ebp - 0x1c98], 0
mov eax, dword [ebp - 0x1c98]
mov dword [ebp - 0x23ec], eax
lea ecx, [ebp - 0x2b34]
call fcn.0043331c
lea ecx, [ebp - 0x1fb4]
call fcn.0043331c
push 2
lea ecx, [ebp - 0x270c]
call fcn.0043324a
mov dword [ebp - 0x2f0], 0x150faeb3
mov dword [ebp - 0x184], 0
jmp 0x471f05
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x471f21
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xcc], 0xfffffffe
jmp 0x471ef8
mov dword [ebp - 0x184], 0
jmp 0x471f3a
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x471f59
push dword [ebp - 0x184]
lea ecx, [ebp - 0x270c]
call fcn.00433338
and dword [eax], 0
jmp 0x471f2d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcc], 0xffffffef
jmp 0x471f87
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 5
je 0x471fc6
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x471fc4
push 0x8d2
push 0
push 0x962
push 0
push 0x1102
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
jmp 0x471f6c
mov eax, 0xffff
test eax, eax
je 0x47202d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
mov dword [ebp - 0x2d70], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
mov dword [ebp - 0x2d78], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 8
jbe 0x472011
mov dword [ebp - 0xcf0], 1
jmp 0x472018
and dword [ebp - 0xcf0], 0
cmp dword [ebp - 0xcf0], 9
jge 0x47202d
mov dword [ebp - 0x1ca0], 1
jmp 0x472034
and dword [ebp - 0x1ca0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ca0]
sub ecx, dword [ebp + eax - 0xcc]
je 0x472057
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
push 0
lea ecx, [ebp - 0x270c]
call fcn.00433338
mov dword [eax], 0x2d34caa8
cmp dword [ebp - 0x2f0], 0x2d34caa8
jge 0x472092
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcc], 0
je 0x472092
mov dword [ebp - 0xcf8], 1
jmp 0x472099
and dword [ebp - 0xcf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0xcf8], eax
jne 0x4720ba
mov dword [ebp - 0x1ca8], 1
jmp 0x4720c1
and dword [ebp - 0x1ca8], 0
mov eax, dword [ebp - 0x2f0]
cmp dword [ebp - 0x1ca8], eax
jne 0x4720db
mov dword [ebp - 0xd00], 1
jmp 0x4720e2
and dword [ebp - 0xd00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0xd00], eax
je 0x472103
mov dword [ebp - 0x1cb0], 1
jmp 0x47210a
and dword [ebp - 0x1cb0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xaa810d21
sub ecx, dword [ebp - 0x1cb0]
sub ecx, dword [ebp - 0x2f0]
cmp dword [ebp + eax - 0xcc], ecx
jle 0x472146
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x472144
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x4721bc
mov dword [ebp - 0x2f0], 0
jmp 0x47215f
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0xfffffff4
je 0x4721bc
mov dword [ebp - 0x8a0], 0
mov dword [ebp - 0x23f4], 0x6fb96f37
mov dword [ebp - 0x8a0], 0x14
jmp 0x472195
mov eax, dword [ebp - 0x8a0]
dec eax
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x8a0], 0xfffffff3
jl 0x4721ba
push 0
lea ecx, [ebp - 0x270c]
call fcn.00433338
or dword [eax], 0xffffffff
mov dword [ebp - 0x23f4], 0x2ff3e141
jmp 0x472188
jmp 0x472152
lea ecx, [ebp - 0x270c]
call fcn.0043331c
mov dword [ebp - 0x2548], 0x62fd41e5
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x658], 0
jmp 0x4721f4
mov eax, dword [ebp - 0x658]
inc eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 3
jge 0x472210
mov eax, dword [ebp - 0x658]
mov dword [ebp + eax*4 - 0x3738], 0xfff6
jmp 0x4721e7
mov dword [ebp - 0x254], 0
jmp 0x472229
cmp dword [ebp - 0x254], 2
jg 0x472253
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x472251
mov dword [ebp - 0x254], 0x11
jmp 0x47226c