Function at 0x46b359
Capabilities:
Allocate thread local storage
Create process on windows
Create thread
Delete file
Delete registry value
Enumerate gui resources
Get common file path
Get file attributes
Hide graphical window
Identify system language via api
Query environment variable
Query or enumerate registry key
Set registry value
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34c4
call fcn.004a1020
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x4782e7
push 2
lea ecx, [ebp - 0x1ffc]
call fcn.00431d6e
mov dword [ebp - 0x3ec], 1
mov dword [ebp - 0x540], 0xfffffff7
mov dword [ebp - 0x408], 0xffffffff
mov dword [ebp - 0x1e30], 0
mov dword [ebp - 0x2284], 0
mov dword [ebp - 0x2310], 0xbe18a167
mov dword [ebp - 0x1e98], 8
mov dword [ebp - 0x3278], 0xffffffff
mov dword [ebp - 0x1de8], 0xfc51
mov dword [ebp - 0x1e90], 0xc83be768
mov dword [ebp - 0x8b4], 7
mov dword [ebp - 0x228c], 1
mov dword [ebp - 0xf0], 0
jmp 0x46b410
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x46b432
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x1ffc]
call fcn.00431e5c
mov dword [eax], 0x55bb2c21
jmp 0x46b403
mov dword [ebp - 0xf0], 0
jmp 0x46b44b
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x46b467
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x22a8], 0x195c588c
jmp 0x46b43e
mov dword [ebp - 0x3ec], 0
jmp 0x46b480
mov eax, dword [ebp - 0x3ec]
inc eax
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 1
jg 0x46b5bb
mov dword [ebp - 0x1db8], 0x3f0bc502
mov dword [ebp - 0x227c], 0
mov dword [ebp - 0x540], 0xffff
cmp dword [ebp - 0x540], 0
jne 0x46b502
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x308c], eax
imul eax, dword [ebp - 0x3ec], 0xf885
cmp eax, 0x842f88d9
je 0x46b4dd
mov dword [ebp - 0x2030], 1
jmp 0x46b4e4
and dword [ebp - 0x2030], 0
mov eax, dword [ebp - 0x1db8]
mov dword [ebp - 0x2e30], eax
mov eax, 0x9d73
test eax, eax
jne 0x46b502
and dword [ebp - 0x1a58], 0
jmp 0x46b50c
mov dword [ebp - 0x1a58], 1
push 1
lea ecx, [ebp - 0x1ffc]
call fcn.00431e5c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1a58]
jge 0x46b52f
mov dword [ebp - 0x1dc0], 1
jmp 0x46b536
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 0x1db8]
cmp eax, dword [ebp - 0x1dc0]
jge 0x46b550
mov dword [ebp - 0x1dc8], 1
jmp 0x46b557
and dword [ebp - 0x1dc8], 0
push 1
lea ecx, [ebp - 0x1ffc]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1dc8]
cmp ecx, dword [eax]
jg 0x46b57a
mov dword [ebp - 0x1dd0], 1
jmp 0x46b581
and dword [ebp - 0x1dd0], 0
cmp dword [ebp - 0x1dd0], 0x9a07
jg 0x46b599
mov dword [ebp - 0x1dd8], 1
jmp 0x46b5a0
and dword [ebp - 0x1dd8], 0
mov eax, dword [ebp - 0x1dd8]
mov dword [ebp - 0x1e30], eax
mov dword [ebp - 0x227c], 0
jmp 0x46b473
cmp dword [ebp - 0x540], 0
jne 0x46b85d
mov eax, dword [ebp - 0x1de8]
mov dword [ebp - 0x3304], eax
mov eax, dword [ebp - 0x1e90]
add eax, 0x3f0d
cmp eax, 0x9656d292
jb 0x46b5f2
mov dword [ebp - 0x1de0], 1
jmp 0x46b5f9
and dword [ebp - 0x1de0], 0
mov eax, dword [ebp - 0x2284]
add eax, dword [ebp - 0x1de0]
cmp eax, 0x5830af36
jne 0x46b618
mov dword [ebp - 0x1df0], 1
jmp 0x46b61f
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0x1de8]
cmp dword [ebp - 0x1df0], eax
jle 0x46b639
mov dword [ebp - 0x1df8], 1
jmp 0x46b640
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x1df8], eax
jl 0x46b65a
mov dword [ebp - 0x1e00], 1
jmp 0x46b661
and dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x1e00], eax
jle 0x46b67b
mov dword [ebp - 0x1e08], 1
jmp 0x46b682
and dword [ebp - 0x1e08], 0
mov eax, dword [ebp - 0x540]
cmp dword [ebp - 0x1e08], eax
jge 0x46b69c
mov dword [ebp - 0x1e10], 1
jmp 0x46b6a3
and dword [ebp - 0x1e10], 0
mov eax, dword [ebp - 0x228c]
imul eax, dword [ebp - 0x1e10]
test eax, eax
jne 0x46b6c6
cmp dword [ebp - 0x408], 0
jne 0x46b6c6
and dword [ebp - 0x1e18], 0
jmp 0x46b6d0
mov dword [ebp - 0x1e18], 1
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x1e18], eax
je 0x46b6ea
mov dword [ebp - 0x1e20], 1
jmp 0x46b6f1
and dword [ebp - 0x1e20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22a8]
mov dword [ebp - 0x2294], eax
mov eax, dword [ebp - 0x1e20]
mov dword [ebp - 0x229c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x22a8], eax
mov eax, dword [ebp - 0x2294]
cmp eax, dword [ebp - 0x229c]
jle 0x46b745
mov dword [ebp - 0x1e28], 1
jmp 0x46b74c
and dword [ebp - 0x1e28], 0
mov eax, dword [ebp - 0x408]
cmp dword [ebp - 0x1e28], eax
jle 0x46b766
mov dword [ebp - 0x1e38], 1
jmp 0x46b76d
and dword [ebp - 0x1e38], 0
mov eax, dword [ebp - 0x1e30]
cmp dword [ebp - 0x1e38], eax
jge 0x46b787
mov dword [ebp - 0x1e40], 1
jmp 0x46b78e
and dword [ebp - 0x1e40], 0
push 0
lea ecx, [ebp - 0x1ffc]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1e40]
cmp ecx, dword [eax]
jl 0x46b7b1
mov dword [ebp - 0x2300], 1
jmp 0x46b7b8
and dword [ebp - 0x2300], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x2e38], eax
xor eax, eax
inc eax
je 0x46b7de
mov eax, 0xc232
test eax, eax
je 0x46b7de
mov dword [ebp - 0x1e48], 1
jmp 0x46b7e5
and dword [ebp - 0x1e48], 0
cmp dword [ebp - 0x1e48], 0x8656
jne 0x46b7fd
mov dword [ebp - 0x1e50], 1
jmp 0x46b804
and dword [ebp - 0x1e50], 0
mov eax, dword [ebp - 0x1e50]
add eax, 0x4e3176a9
cmp eax, dword [ebp - 0x1e98]
jge 0x46b823
mov dword [ebp - 0x1e58], 1
jmp 0x46b82a
and dword [ebp - 0x1e58], 0
cmp dword [ebp - 0x1e58], 1
ja 0x46b83f
mov dword [ebp - 0x1e80], 1
jmp 0x46b846
and dword [ebp - 0x1e80], 0
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x1e80], eax
jg 0x46b85d
and dword [ebp - 0x1e88], 0
jmp 0x46b867
mov dword [ebp - 0x1e88], 1
push 1
lea ecx, [ebp - 0x1ffc]
call fcn.00431e5c
mov eax, dword [eax]
add eax, dword [ebp - 0x1e88]
cmp eax, dword [ebp - 0x1e90]
jg 0x46b890
mov dword [ebp - 0x2308], 1
jmp 0x46b897
and dword [ebp - 0x2308], 0
mov eax, dword [ebp - 0x1e98]
mov dword [ebp - 0x309c], eax
cmp dword [ebp - 0x408], 0x8071c333
jne 0x46b8bb
mov dword [ebp - 0x1ea0], 1
jmp 0x46b8c2
and dword [ebp - 0x1ea0], 0
imul eax, dword [ebp - 0x1ea0], 0xfff8
mov dword [ebp - 0x2310], eax
lea ecx, [ebp - 0x1ffc]
call fcn.00431e40
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x2318], 0x1c17c774
mov dword [ebp - 0x2330], 0x1a83
mov dword [ebp - 0x6e0], 0
jmp 0x46b91b
mov eax, dword [ebp - 0x6e0]
inc eax
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 2
jge 0x46b937
mov eax, dword [ebp - 0x6e0]
mov dword [ebp + eax*4 - 0x22b4], 0xfffffff8
jmp 0x46b90e
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jle 0x46b94b
mov dword [ebp - 0x1ea8], 1
jmp 0x46b952
and dword [ebp - 0x1ea8], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x50]
cmp dword [ebp - 0x1ea8], eax
je 0x46b96d
mov dword [ebp - 0x198c], 1
jmp 0x46b974
and dword [ebp - 0x198c], 0
mov eax, dword [ebp - 0x198c]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0xfff9
je 0x46b9a1
cmp dword [ebp - 0x490], 0
je 0x46b9a1
mov dword [ebp - 0xb4c], 1
jmp 0x46b9a8
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x2318], eax
cmp dword [ebp - 0x50], 0
jbe 0x46b9ca
mov dword [ebp - 0x1994], 1
jmp 0x46b9d1
and dword [ebp - 0x1994], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x1994], eax
jl 0x46ba03
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x46b9fe
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x46bac0
mov dword [ebp - 0x50], 0
jmp 0x46ba13
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x46bac0
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x22b4], 0
jne 0x46ba43
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x22b4], 0x15d3
je 0x46ba43
and dword [ebp - 0xb54], 0
jmp 0x46ba4d
mov dword [ebp - 0xb54], 1
cmp dword [ebp - 0xb54], 0xb8f2ba16
jbe 0x46ba65
mov dword [ebp - 0x199c], 1
jmp 0x46ba6c
and dword [ebp - 0x199c], 0
mov eax, dword [ebp - 0x199c]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
je 0x46ba97
mov dword [ebp - 0x2320], 0xac89d73a
mov dword [ebp - 0x2320], 1
jmp 0x46baab
mov dword [ebp - 0x2328], 1
mov dword [ebp - 0x2328], 0xf3004570
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x2330]
mov dword [ebp + eax*4 - 0x22b4], ecx
jmp 0x46ba0c
mov byte [ebp - 0x23b], 0
movzx eax, byte [ebp - 0x23b]
test eax, eax
je 0x46bad8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x19bc], 0xfb63
mov dword [ebp - 0x2b4], 0xfffffff6
mov dword [ebp - 0x7b0], 4
mov dword [ebp - 0x2338], 0
push 3
lea ecx, [ebp - 0x2a68]
call fcn.00431d6e
mov dword [ebp - 0x98c], 0x2152
mov dword [ebp - 0x19b4], 9
mov dword [ebp - 0x2348], 0xfffffffb
mov dword [ebp - 0xb84], 0xfffffff9
mov dword [ebp - 0x2350], 0xcadcda6a
mov dword [ebp - 0x2e40], 0
mov dword [ebp - 0x548], 0
jmp 0x46bb62
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 3
jge 0x46bb81
push dword [ebp - 0x548]
lea ecx, [ebp - 0x2a68]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x46bb55
cmp dword [ebp - 0x19bc], 0
je 0x46bc7b
mov eax, 0x23e
test eax, eax
je 0x46bc5a
mov eax, dword [ebp - 0x98c]
dec eax
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x2338]
cmp dword [ebp - 0x98c], eax
jl 0x46bbf4
mov eax, dword [ebp - 0x7b0]
add eax, 9
cmp eax, dword [ebp - 0x7b0]
je 0x46bbd3
mov dword [ebp - 0xb5c], 1
jmp 0x46bbda
and dword [ebp - 0xb5c], 0
imul eax, dword [ebp - 0xb5c], 0x4326
test eax, eax
je 0x46bbf4
mov dword [ebp - 0x19a4], 1
jmp 0x46bbfb
and dword [ebp - 0x19a4], 0
imul eax, dword [ebp - 0x19a4], 0xfa48
mov dword [ebp - 0xb64], eax
push 0
lea ecx, [ebp - 0x2a68]
call fcn.00431e5c
mov ecx, dword [ebp - 0xb64]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xb64], eax
je 0x46bc3a
mov dword [ebp - 0x19ac], 1
jmp 0x46bc41
and dword [ebp - 0x19ac], 0
mov eax, dword [ebp - 0x19ac]
shl eax, 3
test eax, eax
je 0x46bc5a
mov dword [ebp - 0xb6c], 1
jmp 0x46bc61
and dword [ebp - 0xb6c], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xb6c], eax
jl 0x46bc7b
mov dword [ebp - 0x2340], 1
jmp 0x46bc82
and dword [ebp - 0x2340], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x322c], eax
mov dword [ebp - 0x19b4], 0x324015fb
mov dword [ebp - 0x2b4], 0x1a
jmp 0x46bcb1
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
jl 0x46bdb3
mov dword [ebp - 0x19d4], 0xffffffff
mov eax, dword [ebp - 0x19b4]
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 0
jle 0x46bce9
mov dword [ebp - 0xb74], 1
jmp 0x46bcf0
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0x2348]
cmp dword [ebp - 0xb74], eax
jle 0x46bd0a
mov dword [ebp - 0xb7c], 1
jmp 0x46bd11
and dword [ebp - 0xb7c], 0
mov eax, dword [ebp - 0x19bc]
cmp dword [ebp - 0xb7c], eax
jle 0x46bd2b
mov dword [ebp - 0x19c4], 1
jmp 0x46bd32
and dword [ebp - 0x19c4], 0
imul eax, dword [ebp - 0x19c4], 9
imul eax, dword [ebp - 0xb84]
cmp eax, dword [ebp - 0xb84]
jl 0x46bd54
mov dword [ebp - 0x19cc], 1
jmp 0x46bd5b
and dword [ebp - 0x19cc], 0
mov eax, dword [ebp - 0x19d4]
cmp dword [ebp - 0x19cc], eax
jne 0x46bd75
mov dword [ebp - 0xb8c], 1
jmp 0x46bd7c
and dword [ebp - 0xb8c], 0
imul eax, dword [ebp - 0xb8c], 0x6309
inc eax
cmp eax, dword [ebp - 0x19d4]
jne 0x46bd9b
mov dword [ebp - 0xb94], 1
jmp 0x46bda2
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0x2350], eax
jmp 0x46bca4
lea ecx, [ebp - 0x2a68]
call fcn.00431e40
mov dword [ebp - 0x6e8], 0x91a049fe
mov dword [ebp - 0x2358], 0xffffffff
mov dword [ebp - 0x550], 0
jmp 0x46bdeb
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 3
jge 0x46be07
mov eax, dword [ebp - 0x550]
mov dword [ebp + eax*4 - 0x332c], 0x5596
jmp 0x46bdde
mov byte [ebp - 0x25f], 0
movzx eax, byte [ebp - 0x25f]
test eax, eax
je 0x46be2c
push 0
push 0x9c5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x332c]
mov dword [ebp - 0x2358], eax
mov dword [ebp - 0x6e8], 2
jmp 0x46be58
mov eax, dword [ebp - 0x6e8]
dec eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 0xfffffffd
je 0x46de2c
mov dword [ebp - 0x558], 1
mov dword [ebp - 0x558], 0
jmp 0x46be88
mov eax, dword [ebp - 0x558]
dec eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0xffffffef
je 0x46bee6
mov byte [ebp - 0x23d], 0
movzx eax, byte [ebp - 0x23d]
test eax, eax
je 0x46bec3
push 0
push 0xd68
push 0x892
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov byte [ebp - 0x261], 0
movzx eax, byte [ebp - 0x261]
test eax, eax
je 0x46bee4
push 0xc13
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x46be7b
mov dword [ebp - 0x410], 0xffffffff
push 1
lea ecx, [ebp - 0x2978]
call fcn.00431d6e
mov dword [ebp - 0x19dc], 0x8593f9be
mov dword [ebp - 0x19fc], 0x7a9d2e81
mov dword [ebp - 0x1a0c], 0xeaa3e8f0
mov dword [ebp - 0x8bc], 0xa5616d21
mov dword [ebp - 0x2360], 0xfffffff6
mov dword [ebp - 0x818], 0
jmp 0x46bf48
mov eax, dword [ebp - 0x818]
inc eax
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 1
jge 0x46bf6a
push dword [ebp - 0x818]
lea ecx, [ebp - 0x2978]
call fcn.00431e5c
mov dword [eax], 0xe923e64f
jmp 0x46bf3b
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x410], eax
jge 0x46bf84
mov dword [ebp - 0xbcc], 1
jmp 0x46bf8b
and dword [ebp - 0xbcc], 0
mov eax, dword [ebp - 0x19dc]
cmp dword [ebp - 0x19dc], eax
jg 0x46bfa5
mov dword [ebp - 0xb9c], 1
jmp 0x46bfac
and dword [ebp - 0xb9c], 0
cmp dword [ebp - 0xb9c], 0xa61bf079
je 0x46bfc4
mov dword [ebp - 0x19e4], 1
jmp 0x46bfcb
and dword [ebp - 0x19e4], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x19e4], eax
je 0x46bfe5
mov dword [ebp - 0xba4], 1
jmp 0x46bfec
and dword [ebp - 0xba4], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0xba4], eax
jl 0x46c006
mov dword [ebp - 0x19ec], 1
jmp 0x46c00d
and dword [ebp - 0x19ec], 0
cmp dword [ebp - 0x19ec], 0xcb27
je 0x46c025
mov dword [ebp - 0xbac], 1
jmp 0x46c02c
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0x19fc]
cmp dword [ebp - 0xbac], eax
jl 0x46c046
mov dword [ebp - 0x19f4], 1
jmp 0x46c04d
and dword [ebp - 0x19f4], 0
mov eax, dword [ebp - 0x19f4]
inc eax
inc eax
test eax, eax
jle 0x46c065
mov dword [ebp - 0xbb4], 1
jmp 0x46c06c
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x410]
cmp eax, dword [ebp - 0xbb4]
je 0x46c086
mov dword [ebp - 0xbbc], 1
jmp 0x46c08d
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0x19fc]
cmp dword [ebp - 0xbbc], eax
jl 0x46c0a7
mov dword [ebp - 0x1a04], 1
jmp 0x46c0ae
and dword [ebp - 0x1a04], 0
mov eax, dword [ebp - 0x1a04]
sub eax, 5
cmp eax, 0x5b689063
jl 0x46c0ca
mov dword [ebp - 0xbc4], 1
jmp 0x46c0d1
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0xbc4]
add eax, 0x547507a
mov dword [ebp - 0x1a0c], eax
cmp dword [ebp - 0x1a0c], 0x77e0
je 0x46c0fa
mov dword [ebp - 0x1a14], 1
jmp 0x46c101
and dword [ebp - 0x1a14], 0
mov eax, dword [ebp - 0xbcc]
neg eax
mov dword [ebp - 0xbd4], eax
push 0
lea ecx, [ebp - 0x2978]
call fcn.00431e5c
mov ecx, dword [ebp - 0xbd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a14]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0xbd4], eax
jg 0x46c153
cmp dword [ebp - 0x8bc], 0
je 0x46c153
mov dword [ebp - 0x1a1c], 1
jmp 0x46c15a
and dword [ebp - 0x1a1c], 0
cmp dword [ebp - 0x1a1c], 1
jbe 0x46c16f
mov dword [ebp - 0xbdc], 1
jmp 0x46c176
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0x2360], eax
lea ecx, [ebp - 0x2978]
call fcn.00431e40
mov dword [ebp - 0x578], 0xfffffff9
mov dword [ebp - 0x514], 0xfe0a8eac
mov dword [ebp - 0x560], 0
jmp 0x46c1ba
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 1
jge 0x46c1d6
mov eax, dword [ebp - 0x560]
mov dword [ebp + eax*4 - 0x2368], 1
jmp 0x46c1ad
mov dword [ebp - 0x514], 9
jmp 0x46c1ef
mov eax, dword [ebp - 0x514]
dec eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0xffffffef
jg 0x46c26c
push 1
lea ecx, [ebp - 0x2a74]
call fcn.00431d6e
mov dword [ebp - 0x6f0], 0
jmp 0x46c21e
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 1
jge 0x46c240
push dword [ebp - 0x6f0]
lea ecx, [ebp - 0x2a74]
call fcn.00431e5c
mov dword [eax], 0xfffffff8
jmp 0x46c211
push 0
lea ecx, [ebp - 0x2a74]
call fcn.00431e5c
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [eax]
mov dword [ebp + ecx - 0x2368], eax
lea ecx, [ebp - 0x2a74]
call fcn.00431e40
jmp 0x46c1e2
mov dword [ebp - 0x514], 0xffffffff
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x2370], 0x1c17c774
mov dword [ebp - 0x2388], 0x1a83
mov dword [ebp - 0x568], 0
jmp 0x46c2b4
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 2
jge 0x46c2d0
mov eax, dword [ebp - 0x568]
mov dword [ebp + eax*4 - 0x22c0], 0xfffffff8
jmp 0x46c2a7
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x46c2e4
mov dword [ebp - 0x1a24], 1
jmp 0x46c2eb
and dword [ebp - 0x1a24], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1a24], eax
je 0x46c306
mov dword [ebp - 0xbe4], 1
jmp 0x46c30d
and dword [ebp - 0xbe4], 0
mov eax, dword [ebp - 0xbe4]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0xfff9
je 0x46c33a
cmp dword [ebp - 0x418], 0
je 0x46c33a
mov dword [ebp - 0x1a2c], 1
jmp 0x46c341
and dword [ebp - 0x1a2c], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x1a2c]
mov dword [ebp - 0x2370], eax
cmp dword [ebp - 0x38], 0
jbe 0x46c363
mov dword [ebp - 0xbec], 1
jmp 0x46c36a
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xbec], eax
jl 0x46c39c
mov byte [ebp - 0x23f], 0
movzx eax, byte [ebp - 0x23f]
test eax, eax
je 0x46c397
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x46c459
mov dword [ebp - 0x38], 0
jmp 0x46c3ac
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x46c459
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x22c0], 0
jne 0x46c3dc
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x22c0], 0x15d3
je 0x46c3dc
and dword [ebp - 0x1a34], 0
jmp 0x46c3e6
mov dword [ebp - 0x1a34], 1
cmp dword [ebp - 0x1a34], 0xb8f2ba16
jbe 0x46c3fe
mov dword [ebp - 0xbf4], 1
jmp 0x46c405
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
je 0x46c430
mov dword [ebp - 0x2378], 0xac89d73a
mov dword [ebp - 0x2378], 1
jmp 0x46c444
mov dword [ebp - 0x2380], 1
mov dword [ebp - 0x2380], 0xf3004570
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2388]
mov dword [ebp + eax*4 - 0x22c0], ecx
jmp 0x46c3a5
mov byte [ebp - 0x263], 0
movzx eax, byte [ebp - 0x263]
test eax, eax
je 0x46c471
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x7b8], 0
jmp 0x46c48a
mov eax, dword [ebp - 0x7b8]
inc eax
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 1
jge 0x46c4a6
mov eax, dword [ebp - 0x7b8]
mov dword [ebp + eax*4 - 0x2e48], 0xfffa
jmp 0x46c47d
mov dword [ebp - 0xa44], 0xcaf1
mov dword [ebp - 0x30ac], 0xe57f6cc9
mov dword [ebp - 0xc24], 0x4956e74e
mov dword [ebp - 0x2e50], 0
mov dword [ebp - 0x1a3c], 0xf63588c5
mov dword [ebp - 0x1a6c], 1
mov dword [ebp - 0x23a0], 5
mov dword [ebp - 0x329c], 7
mov dword [ebp - 0x994], 0xffffffff
mov dword [ebp - 0x6f8], 0xffffffff
mov dword [ebp - 0x2e58], 0x3d1f0dfb
mov dword [ebp - 0x368], 1
mov dword [ebp - 0xc3c], 0xcac31e13
push 3
lea ecx, [ebp - 0x2a8c]
call fcn.00431d6e
mov dword [ebp - 0x8c4], 0xb7c39c9d
mov dword [ebp - 0x23a8], 0x373c
mov dword [ebp - 0x570], 0
jmp 0x46c562
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 3
jge 0x46c584
push dword [ebp - 0x570]
lea ecx, [ebp - 0x2a8c]
call fcn.00431e5c
mov dword [eax], 0xfffffffb
jmp 0x46c555
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0x30bc], eax
mov eax, dword [ebp - 0xa44]
cmp dword [ebp - 0xa44], eax
je 0x46c5aa
mov dword [ebp - 0x1a54], 1
jmp 0x46c5b1
and dword [ebp - 0x1a54], 0
mov eax, dword [ebp - 0x1a3c]
mov dword [ebp - 0x2e60], eax
mov eax, dword [ebp - 0x6f8]
cmp dword [ebp - 0x1a3c], eax
jge 0x46c5d7
mov dword [ebp - 0xbfc], 1
jmp 0x46c5de
and dword [ebp - 0xbfc], 0
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x2390], eax
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0x2398], eax
mov eax, dword [ebp - 0x8c4]
inc eax
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x2390]
cmp eax, dword [ebp - 0x2398]
jg 0x46c61d
mov dword [ebp - 0x1a44], 1
jmp 0x46c624
and dword [ebp - 0x1a44], 0
mov eax, dword [ebp - 0xc24]
cmp dword [ebp - 0x1a44], eax
jge 0x46c63e
mov dword [ebp - 0xc04], 1
jmp 0x46c645
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x23a0]
cmp dword [ebp - 0x994], eax
jle 0x46c66b
mov dword [ebp - 0x1a4c], 1
jmp 0x46c672
and dword [ebp - 0x1a4c], 0
cmp dword [ebp - 0x1a4c], 1
je 0x46c687
mov dword [ebp - 0xc0c], 1
jmp 0x46c68e
and dword [ebp - 0xc0c], 0
cmp dword [ebp - 0xc0c], 4
ja 0x46c6a3
mov dword [ebp - 0xc14], 1
jmp 0x46c6aa
and dword [ebp - 0xc14], 0
mov eax, dword [ebp - 0x1a54]
cmp eax, dword [ebp - 0xc14]
je 0x46c6c4
mov dword [ebp - 0x1a5c], 1
jmp 0x46c6cb
and dword [ebp - 0x1a5c], 0
mov eax, dword [ebp - 0x6f8]
cmp dword [ebp - 0x1a5c], eax
je 0x46c6e5
mov dword [ebp - 0xc1c], 1
jmp 0x46c6ec
and dword [ebp - 0xc1c], 0
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0xffff
jbe 0x46c710
mov dword [ebp - 0x1a64], 1
jmp 0x46c717
and dword [ebp - 0x1a64], 0
push 2
lea ecx, [ebp - 0x2a8c]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1a64]
imul ecx, dword [eax]
add ecx, dword [ebp - 0x1a6c]
mov dword [ebp - 0x6f8], ecx
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x311c], eax
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0x2ed4], eax
cmp dword [ebp - 0x994], 0
cmp dword [ebp - 0x1a6c], 0xa9cb
jle 0x46c770
mov dword [ebp - 0xc2c], 1
jmp 0x46c777
and dword [ebp - 0xc2c], 0
cmp dword [ebp - 0xc2c], 1
jle 0x46c78c
mov dword [ebp - 0x1a74], 1
jmp 0x46c793
and dword [ebp - 0x1a74], 0
mov eax, dword [ebp - 0xc3c]
cmp dword [ebp - 0x1a74], eax
jg 0x46c7ad
mov dword [ebp - 0xc34], 1
jmp 0x46c7b4
and dword [ebp - 0xc34], 0
mov eax, dword [ebp - 0x23a8]
cmp dword [ebp - 0xc34], eax
jg 0x46c7ce
mov dword [ebp - 0x1a7c], 1
jmp 0x46c7d5
and dword [ebp - 0x1a7c], 0
mov eax, dword [ebp - 0x1a7c]
mov dword [ebp - 0xc3c], eax
mov dword [ebp - 0x368], 2
jmp 0x46c7fa
mov eax, dword [ebp - 0x368]
dec eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0
jl 0x46c81d
mov byte [ebp - 0x241], 0
movzx eax, byte [ebp - 0x241]
test eax, eax
je 0x46c81b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x46c7ed
lea ecx, [ebp - 0x2a8c]
call fcn.00431e40
mov dword [ebp - 0x578], 0
jmp 0x46c841
cmp dword [ebp - 0x578], 0
jl 0x46de27
mov dword [ebp - 0x94], 0
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0x1a84], 0xffffffff
push 3
lea ecx, [ebp - 0x2458]
call fcn.00431d6e
mov dword [ebp - 0x848], 0
jmp 0x46c892
mov eax, dword [ebp - 0x848]
inc eax
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x848], 3
jge 0x46c8b4
push dword [ebp - 0x848]
lea ecx, [ebp - 0x2458]
call fcn.00431e5c
mov dword [eax], 0x2c9ebf49
jmp 0x46c885
mov dword [ebp - 0x94], 0
jmp 0x46c8cd
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x14
jle 0x46c8e3
cmp dword [ebp - 0x94], 0
je 0x46c8e1
jmp 0x46c8e3
jmp 0x46c8c0
mov dword [ebp - 0x94], 0
jmp 0x46c8fc
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 8
jne 0x46c9f5
mov dword [ebp - 0xc4c], 5
mov dword [ebp - 0xc54], 0xfffffff7
mov byte [ebp - 0x265], 0
movzx eax, byte [ebp - 0x265]
test eax, eax
je 0x46c937
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0xc44], 0xffffffff
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1a84], eax
imul eax, dword [ebp - 0x1a84], 0
cmp dword [ebp - 0xc44], eax
jge 0x46c968
mov dword [ebp - 0x1a8c], 1
jmp 0x46c96f
and dword [ebp - 0x1a8c], 0
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0x32b8], eax
mov eax, dword [ebp - 0x1a8c]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0x1a94], eax
push 1
lea ecx, [ebp - 0x2458]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1a94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1a94], eax
je 0x46c9d1
push 1
lea ecx, [ebp - 0x2458]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x46c9d1
and dword [ebp - 0x23b0], 0
jmp 0x46c9db
mov dword [ebp - 0x23b0], 1
push 1
lea ecx, [ebp - 0x2458]
call fcn.00431e5c
mov eax, dword [eax]
mov dword [ebp - 0xc54], eax
jmp 0x46c8ef
lea ecx, [ebp - 0x2458]
call fcn.00431e40
mov byte [ebp - 0x267], 0
push 4
lea ecx, [ebp - 0x3f8]
call fcn.00431d6e
mov dword [ebp - 0x2edc], 1
mov dword [ebp - 0x580], 0
jmp 0x46ca37
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 4
jge 0x46ca59
push dword [ebp - 0x580]
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov dword [eax], 9
jmp 0x46ca2a
push 2
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
cmp dword [eax], 1
jae 0x46ca77
mov dword [ebp - 0x1a9c], 1
jmp 0x46ca7e
and dword [ebp - 0x1a9c], 0
push 3
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1a9c]
cmp ecx, dword [eax]
jg 0x46caa1
mov dword [ebp - 0xc5c], 1
jmp 0x46caa8
and dword [ebp - 0xc5c], 0
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov esi, eax
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov eax, dword [eax]
imul eax, dword [ebp - 0xc5c]
cmp dword [esi], eax
jg 0x46cadd
mov dword [ebp - 0x1aa4], 1
jmp 0x46cae4
and dword [ebp - 0x1aa4], 0
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1aa4]
cmp ecx, dword [eax]
jge 0x46cb07
mov dword [ebp - 0xc64], 1
jmp 0x46cb0e
and dword [ebp - 0xc64], 0
push 2
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [ebp - 0xc64]
cmp ecx, dword [eax]
jle 0x46cb31
mov dword [ebp - 0x1aac], 1
jmp 0x46cb38
and dword [ebp - 0x1aac], 0
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1aac]
cmp ecx, dword [eax]
jge 0x46cb5b
mov dword [ebp - 0xc6c], 1
jmp 0x46cb62
and dword [ebp - 0xc6c], 0
cmp dword [ebp - 0xc6c], 0xffff
jne 0x46cb7a
mov dword [ebp - 0x23b8], 1
jmp 0x46cb81
and dword [ebp - 0x23b8], 0
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov esi, eax
push 3
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x46cbbc
mov dword [ebp - 0x1ab4], 1
jmp 0x46cbc3
and dword [ebp - 0x1ab4], 0
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1ab4]
cmp ecx, dword [eax]
jne 0x46cbe6
mov dword [ebp - 0xc74], 1
jmp 0x46cbed
and dword [ebp - 0xc74], 0
push 3
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov ecx, dword [ebp - 0xc74]
sub ecx, dword [eax]
je 0x46cc27
mov byte [ebp - 0x243], 0
movzx eax, byte [ebp - 0x243]
test eax, eax
je 0x46cc22
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x46ce06
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x23c0], 1
push 2
lea ecx, [ebp - 0x2680]
call fcn.00431d6e
mov dword [ebp - 0x23c8], 0xdba5
mov dword [ebp - 0x700], 0
jmp 0x46cc6b
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 2
jge 0x46cc8d
push dword [ebp - 0x700]
lea ecx, [ebp - 0x2680]
call fcn.00431e5c
mov dword [eax], 6
jmp 0x46cc5e
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
cmp dword [eax], 0
je 0x46ccbd
push 1
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
cmp dword [eax], 0
je 0x46ccbd
mov dword [ebp - 0x1abc], 1
jmp 0x46ccc4
and dword [ebp - 0x1abc], 0
cmp dword [ebp - 0x1abc], 0x1465ee6
jne 0x46ccdc
mov dword [ebp - 0x1ac4], 1
jmp 0x46cce3
and dword [ebp - 0x1ac4], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x312c], eax
cmp dword [ebp - 0x23c0], 0
jne 0x46cd13
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x46cd13
and dword [ebp - 0xc7c], 0
jmp 0x46cd1d
mov dword [ebp - 0xc7c], 1
mov eax, dword [ebp - 0xc7c]
sub eax, 0x5f49
mov ecx, dword [ebp - 0x1ac4]
imul ecx, eax
mov dword [ebp - 0xc84], ecx
push 0
lea ecx, [ebp - 0x2680]
call fcn.00431e5c
mov ecx, dword [ebp - 0xc84]
mov dword [eax], ecx
cmp dword [ebp - 0xc84], 1
jb 0x46cd61
mov dword [ebp - 0x1ad8], 1
jmp 0x46cd68
and dword [ebp - 0x1ad8], 0
push 0
lea ecx, [ebp - 0x3f8]
call fcn.00431e5c
mov eax, dword [eax]
sub eax, dword [ebp - 0x23c8]
je 0x46cda1
mov dword [ebp - 0x23d0], 0xe29a
mov dword [ebp - 0x23d8], 0xffffffff
mov eax, dword [ebp - 0x23d0]
mov dword [ebp - 0x23d8], eax
jmp 0x46cdc0
mov byte [ebp - 0x256], 0
movzx eax, byte [ebp - 0x256]
test eax, eax
je 0x46cdc0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x3e8], 0
jmp 0x46cdd9
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 2
jge 0x46cdfb
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x2680]
call fcn.00431e5c
mov dword [eax], 0xba430906
jmp 0x46cdcc
lea ecx, [ebp - 0x2680]
call fcn.00431e40
lea ecx, [ebp - 0x3f8]
call fcn.00431e40
movzx eax, byte [ebp - 0x267]
test eax, eax
je 0x46d145
mov dword [ebp - 0x7c0], 8
push 1
lea ecx, [ebp - 0xa68]
call fcn.00431d6e
mov dword [ebp - 0x1af8], 0xeb2d3650
mov dword [ebp - 0x23e0], 0xfffffffb
mov dword [ebp - 0x1b08], 0xc650ba43
mov dword [ebp - 0xa08], 0x769e
mov dword [ebp - 0x23f0], 0
mov dword [ebp - 0x588], 0
jmp 0x46ce82
mov eax, dword [ebp - 0x588]
inc eax
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x588], 1
jge 0x46cea1
push dword [ebp - 0x588]
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x46ce75
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0xc8c], eax
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
mov ecx, dword [ebp - 0xc8c]
mov dword [eax], ecx
cmp dword [ebp - 0xc8c], 0
je 0x46d0e1
cmp dword [ebp - 0x1af8], 1
jle 0x46cee5
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
cmp dword [eax], 0x6896
jge 0x46cf06
mov dword [ebp - 0x1ae0], 1
jmp 0x46cf0d
and dword [ebp - 0x1ae0], 0
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1ae0]
cmp ecx, dword [eax]
jg 0x46cf30
mov dword [ebp - 0xc94], 1
jmp 0x46cf37
and dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0x7c0]
cmp dword [ebp - 0xc94], eax
je 0x46cf51
mov dword [ebp - 0x1ae8], 1
jmp 0x46cf58
and dword [ebp - 0x1ae8], 0
cmp dword [ebp - 0x1ae8], 0xbe74fd57
ja 0x46cf70
mov dword [ebp - 0xc9c], 1
jmp 0x46cf77
and dword [ebp - 0xc9c], 0
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
mov ecx, dword [ebp - 0xc9c]
cmp ecx, dword [eax]
jle 0x46cf9a
mov dword [ebp - 0x1af0], 1
jmp 0x46cfa1
and dword [ebp - 0x1af0], 0
mov eax, dword [ebp - 0x7c0]
cmp dword [ebp - 0x1af0], eax
jl 0x46cfbb
mov dword [ebp - 0xca4], 1
jmp 0x46cfc2
and dword [ebp - 0xca4], 0
mov eax, 0x70669599
sub eax, dword [ebp - 0xca4]
cmp eax, dword [ebp - 0x1af8]
jl 0x46cfe1
mov dword [ebp - 0xcac], 1
jmp 0x46cfe8
and dword [ebp - 0xcac], 0
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
mov ecx, dword [ebp - 0xcac]
cmp ecx, dword [eax]
jg 0x46d00b
mov dword [ebp - 0x1b00], 1
jmp 0x46d012
and dword [ebp - 0x1b00], 0
mov eax, dword [ebp - 0x23e0]
cmp dword [ebp - 0x1b00], eax
jge 0x46d02c
mov dword [ebp - 0x8cc], 1
jmp 0x46d033
and dword [ebp - 0x8cc], 0
push 0
lea ecx, [ebp - 0xa68]
call fcn.00431e5c
mov ecx, dword [ebp - 0x8cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c0]
cmp dword [ebp - 0x8cc], eax
jge 0x46d062
mov dword [ebp - 0xcb4], 1
jmp 0x46d069
and dword [ebp - 0xcb4], 0
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0x1b08], eax
imul eax, dword [ebp - 0x1b08], 0xffffffff
cmp eax, 0xca7bc41b
ja 0x46d08f
mov dword [ebp - 0xcbc], 1
jmp 0x46d096
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0xa08]
cmp dword [ebp - 0xcbc], eax
jle 0x46d0b0
and dword [ebp - 0x1b10], 0
cmp dword [ebp - 0x1b10], 0x33d4965d
jge 0x46d100
mov dword [ebp - 0xcc4], 1
jmp 0x46d107
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0xa08]
add eax, dword [ebp - 0xcc4]
jne 0x46d121
mov dword [ebp - 0x1b18], 1
jmp 0x46d128
and dword [ebp - 0x1b18], 0
mov eax, dword [ebp - 0x1b18]
mov dword [ebp - 0x23f0], eax
lea ecx, [ebp - 0xa68]
call fcn.00431e40
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0x23f8], 0xf572
mov dword [ebp - 0x2400], 0x7730f94f
mov dword [ebp - 0x3254], 0x2bb11acc
mov dword [ebp - 0x2eec], 1
mov dword [ebp - 0x313c], 9
mov dword [ebp - 0x2ef4], 4
push 1
lea ecx, [ebp - 0x2fe8]
call fcn.00431d6e
mov dword [ebp - 0x32bc], 0x3a92bd42
mov dword [ebp - 0xccc], 0x2ba29f58
mov dword [ebp - 0x590], 0
jmp 0x46d1bb
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
cmp dword [ebp - 0x590], 1
jge 0x46d1dd
push dword [ebp - 0x590]
lea ecx, [ebp - 0x2fe8]
call fcn.00431e5c
mov dword [eax], 2
jmp 0x46d1ae
mov eax, dword [ebp - 0x23f8]
mov dword [ebp - 0x2400], eax
mov eax, dword [ebp - 0xccc]
inc eax
mov dword [ebp - 0xccc], eax
lea ecx, [ebp - 0x2fe8]
call fcn.00431e40
mov byte [ebp - 0x269], 0
mov dword [ebp - 0x49c], 0x3638ecf5
mov dword [ebp - 0x5a0], 0x126ff23b
push 2
lea ecx, [ebp - 0xa98]
call fcn.00431d6e
mov dword [ebp - 0x1b38], 0xfffffff7
mov dword [ebp - 0x164], 0
jmp 0x46d24c
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x46d26e
push dword [ebp - 0x164]
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
mov dword [eax], 0xe08cccdd
jmp 0x46d23f
mov dword [ebp - 0x164], 0
jmp 0x46d287
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x46d2a3
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x598], 9
jmp 0x46d27a
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x49c], eax
jge 0x46d2bd
mov dword [ebp - 0x1b20], 1
jmp 0x46d2c4
and dword [ebp - 0x1b20], 0
mov eax, dword [ebp - 0x1b20]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x49c], eax
jge 0x46d2ea
mov dword [ebp - 0xcd4], 1
jmp 0x46d2f1
and dword [ebp - 0xcd4], 0
push 1
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
mov ecx, dword [ebp - 0xcd4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x598]
cmp dword [ebp - 0x49c], eax
jle 0x46d327
mov dword [ebp - 0x1b28], 1
jmp 0x46d32e
and dword [ebp - 0x1b28], 0
push 1
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1b28]
je 0x46d49a
mov dword [ebp - 0x708], 0xffffffff
mov dword [ebp - 0x2420], 0x4d25
mov dword [ebp - 0x2428], 0xfffffffd
mov dword [ebp - 0x2430], 0xea3a
cmp dword [ebp - 0x708], 0xf928
jne 0x46d389
mov dword [ebp - 0xcdc], 1
jmp 0x46d390
and dword [ebp - 0xcdc], 0
push 6
pop eax
test eax, eax
je 0x46d3e4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x598], 0
jne 0x46d3b9
cmp dword [ebp - 0x708], 0
jne 0x46d3b9
and dword [ebp - 0x2408], 0
jmp 0x46d3c3
mov dword [ebp - 0x2408], 1
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x2efc], eax
mov eax, 0x7b83
test eax, eax
je 0x46d3e4
mov dword [ebp - 0x2410], 1
jmp 0x46d3eb
and dword [ebp - 0x2410], 0
push 1
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
cmp dword [ebp - 0xcdc], 0x4cc511ec
jge 0x46d416
cmp dword [ebp - 0x708], 0
jne 0x46d416
and dword [ebp - 0x2418], 0
jmp 0x46d420
mov dword [ebp - 0x2418], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x598]
mov dword [ebp - 0x314c], eax
push 0xfffffffffffffffe
pop eax
sub eax, dword [ebp - 0x2420]
jne 0x46d450
cmp dword [ebp - 0x2428], 0
jne 0x46d450
and dword [ebp - 0x1b30], 0
jmp 0x46d45a
mov dword [ebp - 0x1b30], 1
cmp dword [ebp - 0x1b30], 0xfff9
jbe 0x46d472
mov dword [ebp - 0xce4], 1
jmp 0x46d479
and dword [ebp - 0xce4], 0
mov esi, dword [ebp - 0x2430]
imul esi, dword [ebp - 0xce4]
push 0
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
mov dword [eax], esi
jmp 0x46d711
mov dword [ebp - 0xcf4], 1
push 1
lea ecx, [ebp - 0x26f8]
call fcn.00431d6e
mov dword [ebp - 0x1b50], 0xf61ca727
mov dword [ebp - 0xf8], 0
jmp 0x46d4d4
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x46d4f0
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x2ff8], 0x90f6
jmp 0x46d4c7
mov dword [ebp - 0xf8], 0
jmp 0x46d509
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x46d52b
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x26f8]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x46d4fc
mov byte [ebp - 0x245], 0
movzx eax, byte [ebp - 0x245]
test eax, eax
je 0x46d54f
push 0x36b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 0
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
mov esi, eax
push 0
lea ecx, [ebp - 0xa98]
call fcn.00431e5c
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x46d57d
jmp 0x46be4b
mov dword [ebp - 0x718], 0xebaeef20
mov dword [ebp - 0x5b0], 0
jmp 0x46de4f
mov eax, dword [ebp - 0x5b0]
inc eax
mov dword [ebp - 0x5b0], eax
cmp dword [ebp - 0x5b0], 1
jge 0x46de6b
mov eax, dword [ebp - 0x5b0]
mov dword [ebp + eax*4 - 0x2be4], 1
jmp 0x46de42
mov dword [ebp - 0x718], 0
jmp 0x46de84
mov eax, dword [ebp - 0x718]
inc eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 0
jg 0x46df33
mov dword [ebp - 0x378], 0xfffffff9
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x378], 0
jmp 0x46dec0
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0
jg 0x46df2e
mov dword [ebp - 0x3d0], 0x9b79
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3d0], 0
jmp 0x46def9
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jg 0x46df2c
mov byte [ebp - 0x249], 0
movzx eax, byte [ebp - 0x249]
test eax, eax
je 0x46df2a
push 0
push 0
push 0x91a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46deec
jmp 0x46deb3
jmp 0x46de77
push 1
lea eax, [ebp - 0x3474]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.00467a5c
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x3374]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3374]
lea edi, [ebp - 0x27b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x70], 0x5e48d327
mov dword [ebp - 0x8dc], 0xe5a9864b
mov dword [ebp - 0x4dc], 0x821342f3
mov dword [ebp - 0x70], 0
jmp 0x46df8d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x19
je 0x46e2e9
mov dword [ebp - 0x16c], 2
mov dword [ebp - 0x428], 6
cmp dword [ebp - 0x16c], 0
je 0x46dfc6
cmp dword [ebp - 0x70], 0
je 0x46dfc6
mov dword [ebp - 0xd84], 1
jmp 0x46dfcd
and dword [ebp - 0xd84], 0
cmp dword [ebp - 0xd84], 0xfac1
je 0x46dfe5
mov dword [ebp - 0xd94], 1
jmp 0x46dfec
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2bec], eax
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x16c], eax
jle 0x46e00f
mov dword [ebp - 0x1bd8], 1
jmp 0x46e016
and dword [ebp - 0x1bd8], 0
cmp dword [ebp - 0x1bd8], 0xfffffffb
jle 0x46e02b
mov dword [ebp - 0xd8c], 1
jmp 0x46e032
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x4dc], eax
jg 0x46e055
mov dword [ebp - 0x1be0], 1
jmp 0x46e05c
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x1be0]
add eax, 0xb5af
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x8dc]
imul eax, dword [ebp - 0x4dc]
cmp eax, dword [ebp - 0x16c]
jle 0x46e09a
mov dword [ebp - 0x1be8], 1
jmp 0x46e0a1
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x1be8], eax
je 0x46e0bb
mov dword [ebp - 0xd9c], 1
jmp 0x46e0c2
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0xd9c]
test eax, eax
jg 0x46e0df
mov dword [ebp - 0x1bf0], 1
jmp 0x46e0e6
and dword [ebp - 0x1bf0], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1bf0], eax
jne 0x46e0fd
mov dword [ebp - 0xda4], 1
jmp 0x46e104
and dword [ebp - 0xda4], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xda4], eax
jge 0x46e11b
mov dword [ebp - 0x2634], 1
jmp 0x46e122
and dword [ebp - 0x2634], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x2bf4], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x2bfc], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x46e2ce
mov dword [ebp - 0x1bf8], 0x61940c9b
mov dword [ebp - 0x263c], 4
mov dword [ebp - 0x2644], 0x2f1efae0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x1bf8], eax
cmp dword [ebp - 0x1bf8], 0
je 0x46e254
cmp dword [ebp - 0x70], 0xbdae8940
jne 0x46e18e
mov dword [ebp - 0xdac], 1
jmp 0x46e195
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0xdac]
inc eax
cmp eax, dword [ebp - 0x4dc]
jl 0x46e1b0
mov dword [ebp - 0x1c00], 1
jmp 0x46e1b7
and dword [ebp - 0x1c00], 0
mov eax, dword [ebp - 0x428]
cmp eax, dword [ebp - 0x1c00]
jl 0x46e1d1
mov dword [ebp - 0xdb4], 1
jmp 0x46e1d8
and dword [ebp - 0xdb4], 0
mov eax, dword [ebp - 0x263c]
cmp dword [ebp - 0xdb4], eax
jg 0x46e1f2
mov dword [ebp - 0x1c08], 1
jmp 0x46e1f9
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1c08], eax
je 0x46e210
mov dword [ebp - 0xdbc], 1
jmp 0x46e217
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 0
jae 0x46e22c
mov dword [ebp - 0x1c10], 1
jmp 0x46e233
and dword [ebp - 0x1c10], 0
mov eax, dword [ebp - 0x1c10]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x46e254
mov dword [ebp - 0xdc4], 1
jmp 0x46e25b
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xfffffffa
jne 0x46e27c
mov dword [ebp - 0x1c18], 1
jmp 0x46e283
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x1c18], eax
je 0x46e29a
mov dword [ebp - 0xdcc], 1
jmp 0x46e2a1
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xdcc]
mov dword [ebp - 0x2644], eax
mov byte [ebp - 0x26d], 0
movzx eax, byte [ebp - 0x26d]
test eax, eax
je 0x46e2cc
push 0x1119
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x46e2e4
cmp dword [ebp - 0x428], 0
je 0x46e2d9
jmp 0x46e2e9
cmp dword [ebp - 0x8dc], 0
je 0x46e2e4
jmp 0x46e2e9
jmp 0x46df86
and dword [ebp - 0x28b8], 0
and dword [ebp - 0x28b4], 0
and dword [ebp - 0x28b0], 0
and dword [ebp - 0x28ac], 0
lea ecx, [ebp - 0x9ed]
call fcn.00431e6b
push eax
lea eax, [ebp - 0x28a8]
push eax
lea eax, [ebp - 0x28b8]
push eax
lea ecx, [ebp - 0x33c0]
call fcn.00431e6e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2728]
call fcn.00431e1a
push 0
lea ecx, [ebp - 0x2728]
call fcn.00431e5c
mov dword [eax], 0xffffffe6
jmp 0x46e373
push 0
lea ecx, [ebp - 0x2728]
call fcn.00431e5c
mov dword [ebp - 0x1c20], eax
mov eax, dword [ebp - 0x1c20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c20]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2728]
call fcn.00431e5c
cmp dword [eax], 0x16
jne 0x46e3c1
mov byte [ebp - 0x24b], 0
movzx eax, byte [ebp - 0x24b]
test eax, eax
je 0x46e3a1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov byte [ebp - 0x26f], 0
movzx eax, byte [ebp - 0x26f]
test eax, eax
je 0x46e3bf
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
jmp 0x46e34f
lea ecx, [ebp - 0x2728]
call fcn.00431e40
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x1c30], 0xfffffffa
mov dword [ebp - 0x264c], 1
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x2654], 0xf726845d
mov dword [ebp - 0x2bc], 0
jmp 0x46e417
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xfffffff4
jge 0x46e4e5
mov dword [ebp - 0x2c04], 0xbf495e3b
push 1
lea ecx, [ebp - 0x2a80]
call fcn.00431d6e
mov dword [ebp - 0x5b8], 0
jmp 0x46e454
mov eax, dword [ebp - 0x5b8]
inc eax
mov dword [ebp - 0x5b8], eax
cmp dword [ebp - 0x5b8], 1
jge 0x46e476
push dword [ebp - 0x5b8]
lea ecx, [ebp - 0x2a80]
call fcn.00431e5c
mov dword [eax], 0xd9a2b82c
jmp 0x46e447
cmp dword [ebp - 0x2bc], 0
jne 0x46e491
mov eax, 0x3c8e79b
test eax, eax
jne 0x46e491
and dword [ebp - 0xdd4], 0
jmp 0x46e49b
mov dword [ebp - 0xdd4], 1
mov eax, dword [ebp - 0xdd4]
sub eax, 0x32cd2c9b
cmp eax, 0xd0e7
jge 0x46e4b9
mov dword [ebp - 0x1c28], 1
jmp 0x46e4c0
and dword [ebp - 0x1c28], 0
push 0
lea ecx, [ebp - 0x2a80]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1c28]
mov dword [eax], ecx
lea ecx, [ebp - 0x2a80]
call fcn.00431e40
jmp 0x46e40a
mov eax, dword [ebp - 0x264c]
mov dword [ebp - 0x2c0c], eax
xor eax, eax
inc eax
je 0x46e50b
cmp dword [ebp - 0x86c], 0
je 0x46e50b
mov dword [ebp - 0xddc], 1
jmp 0x46e512
and dword [ebp - 0xddc], 0
cmp dword [ebp - 0xddc], 0xfffffffd
je 0x46e527
mov dword [ebp - 0xde4], 1
jmp 0x46e52e
and dword [ebp - 0xde4], 0
mov dword [ebp - 0x2bc], 0x5524
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x1c30], eax
mov eax, dword [ebp - 0x1c30]
cmp eax, dword [ebp - 0xde4]
je 0x46e55e
mov dword [ebp - 0x1c38], 1
jmp 0x46e565
and dword [ebp - 0x1c38], 0
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x1c38], eax
jg 0x46e57f
mov dword [ebp - 0xdec], 1
jmp 0x46e586
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0xdec]
sub eax, dword [ebp - 0x86c]
cmp eax, dword [ebp - 0x86c]
jl 0x46e5a6
mov dword [ebp - 0x1c40], 1
jmp 0x46e5ad
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x1c40]
mov dword [ebp - 0x2654], eax
push 2
lea ecx, [ebp - 0x1f9c]
call fcn.00431d6e
mov dword [ebp - 0x84], 0x4801897a
push 2
lea ecx, [ebp - 0x1f3c]
call fcn.00431d6e
mov dword [ebp - 0x2674], 1
mov dword [ebp - 0x2040], 0xdbfd33f1
mov dword [ebp - 0x5c0], 0
jmp 0x46e60a
mov eax, dword [ebp - 0x5c0]
inc eax
mov dword [ebp - 0x5c0], eax
cmp dword [ebp - 0x5c0], 2
jge 0x46e62c
push dword [ebp - 0x5c0]
lea ecx, [ebp - 0x1f3c]
call fcn.00431e5c
mov dword [eax], 0xfffffffb
jmp 0x46e5fd
mov byte [ebp - 0x24d], 0
movzx eax, byte [ebp - 0x24d]
test eax, eax
je 0x46e648
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp dword [ebp - 0x84], 0
je 0x46e90d
mov dword [ebp - 0x5c8], 2
mov dword [ebp - 0x84], 0
jmp 0x46e678
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x14
jl 0x46e908
mov dword [ebp - 0x4a4], 0xc08872fa
push 3
lea ecx, [ebp - 0x2468]
call fcn.00431d6e
mov dword [ebp - 0xa3c], 1
mov dword [ebp - 0x1c48], 0x3f0d3ecf
mov dword [ebp - 0x265c], 0xe7374489
mov dword [ebp - 0x720], 0
jmp 0x46e6d3
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 3
jge 0x46e6f5
push dword [ebp - 0x720]
lea ecx, [ebp - 0x2468]
call fcn.00431e5c
mov dword [eax], 0xfffffff8
jmp 0x46e6c6
cmp dword [ebp - 0x4a4], 0
je 0x46e78c
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x2c14], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xdf4], eax
push 2
lea ecx, [ebp - 0x2468]
call fcn.00431e5c
mov ecx, dword [ebp - 0xdf4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdf4]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0x1c48], eax
mov eax, dword [ebp - 0x1c48]
sub eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x4a4]
neg ecx
cmp ecx, eax
jne 0x46e76b
mov dword [ebp - 0xdfc], 1
jmp 0x46e772
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0x5c8]
cmp eax, dword [ebp - 0xdfc]
jne 0x46e78c
mov dword [ebp - 0x1c50], 1
jmp 0x46e793
and dword [ebp - 0x1c50], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x1c50], eax
jne 0x46e7ad
mov dword [ebp - 0xe04], 1
jmp 0x46e7b4
and dword [ebp - 0xe04], 0
cmp dword [ebp - 0xe04], 9
jb 0x46e8d8
mov dword [ebp - 0x1c60], 0xfe2
mov dword [ebp - 0x2664], 0x1a88af16
cmp dword [ebp - 0x5c8], 0
jne 0x46e7f0
cmp dword [ebp - 0xa3c], 0
jne 0x46e7f0
and dword [ebp - 0x1c58], 0
jmp 0x46e7fa
mov dword [ebp - 0x1c58], 1
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x1c58], eax
jg 0x46e814
mov dword [ebp - 0xe0c], 1
jmp 0x46e81b
and dword [ebp - 0xe0c], 0
mov eax, dword [ebp - 0xe0c]
mov dword [ebp - 0x1c60], eax
mov eax, dword [ebp - 0x1c60]
mov dword [ebp - 0x2c1c], eax
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x2c24], eax
mov esi, dword [ebp - 0x4a4]
push 0
lea ecx, [ebp - 0x2468]
call fcn.00431e5c
cmp esi, dword [eax]
je 0x46e862
mov dword [ebp - 0xe14], 1
jmp 0x46e869
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0xe14], eax
jge 0x46e883
mov dword [ebp - 0x1c68], 1
jmp 0x46e88a
and dword [ebp - 0x1c68], 0
mov eax, dword [ebp - 0x265c]
cmp dword [ebp - 0x1c68], eax
jg 0x46e8a4
mov dword [ebp - 0xe1c], 1
jmp 0x46e8ab
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0x2664], eax
mov byte [ebp - 0x271], 0
movzx eax, byte [ebp - 0x271]
test eax, eax
je 0x46e8d6
push 0
push 0x22b2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x46e8f8
mov dword [ebp - 0x266c], 0
cmp dword [ebp - 0x266c], 0
je 0x46e8f8
lea ecx, [ebp - 0x2468]
call fcn.00431e40
jmp 0x46e908
lea ecx, [ebp - 0x2468]
call fcn.00431e40
jmp 0x46e66b
jmp 0x46ea7b
mov dword [ebp - 0x7d0], 2
cmp dword [ebp - 0x84], 0
jne 0x46e9d2
cmp dword [ebp - 0x84], 1
jge 0x46e939
mov dword [ebp - 0x1c70], 1
jmp 0x46e940
and dword [ebp - 0x1c70], 0
mov eax, dword [ebp - 0x1c70]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x2c2c], eax
push 1
lea ecx, [ebp - 0x1f3c]
call fcn.00431e5c
mov esi, dword [ebp - 0x7d0]
push 1
lea ecx, [ebp - 0x1f3c]
call fcn.00431e5c
cmp esi, dword [eax]
jl 0x46e98a
or eax, 0xffffffff
jne 0x46e98a
and dword [ebp - 0xe24], 0
jmp 0x46e994
mov dword [ebp - 0xe24], 1
mov esi, dword [ebp - 0xe24]
sub esi, dword [ebp - 0x2674]
push 1
lea ecx, [ebp - 0x1f3c]
call fcn.00431e5c
cmp esi, dword [eax]
jg 0x46e9bd
mov dword [ebp - 0x2274], 1
jmp 0x46e9c4
and dword [ebp - 0x2274], 0
or eax, 0xffffffff
jne 0x46e9d2
and dword [ebp - 0x1c78], 0
jmp 0x46e9dc
mov dword [ebp - 0x1c78], 1
cmp dword [ebp - 0x1c78], 0xfffffff7
jae 0x46e9f1
mov dword [ebp - 0xe2c], 1
jmp 0x46e9f8
and dword [ebp - 0xe2c], 0
mov esi, dword [ebp - 0x7d0]
add esi, dword [ebp - 0xe2c]
push 0
lea ecx, [ebp - 0x1f3c]
call fcn.00431e5c
cmp esi, dword [eax]
jne 0x46ea30
push 1
lea ecx, [ebp - 0x1f3c]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x46ea30
and dword [ebp - 0x1c80], 0
jmp 0x46ea3a
mov dword [ebp - 0x1c80], 1
cmp dword [ebp - 0x1c80], 0x4b05
jle 0x46ea52
mov dword [ebp - 0x212c], 1
jmp 0x46ea59
and dword [ebp - 0x212c], 0
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x2c34], eax
mov eax, dword [ebp - 0x2040]
mov dword [ebp - 0x2c3c], eax
mov dword [ebp - 0x7d0], 6
lea ecx, [ebp - 0x1f3c]
call fcn.00431e40
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0x2c44], 0xfffa
mov byte [ebp - 0x24f], 0
movzx eax, byte [ebp - 0x24f]
test eax, eax
je 0x46ead1
push 0x18a5
push 0
push 0x134c
push 0x269f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov byte [ebp - 0x273], 0
movzx eax, byte [ebp - 0x273]
test eax, eax
je 0x46eaeb
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 0x830], 0xfffffff7
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x5d0], 0
jmp 0x46eb18
mov eax, dword [ebp - 0x5d0]
inc eax
mov dword [ebp - 0x5d0], eax
cmp dword [ebp - 0x5d0], 3
jge 0x46eb34
mov eax, dword [ebp - 0x5d0]
mov dword [ebp + eax*4 - 0x335c], 0xffffffff
jmp 0x46eb0b
mov dword [ebp - 0x174], 0
jmp 0x46eb4d
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jg 0x46ec15
mov dword [ebp - 0x2c4c], 0xb844a754
push 3
lea ecx, [ebp - 0x2b10]
call fcn.00431d6e
mov dword [ebp - 0x100], 0
jmp 0x46eb8a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x46eba6
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x2c54], 0x4074dd03
jmp 0x46eb7d
mov dword [ebp - 0x100], 0
jmp 0x46ebbf
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x46ebe1
push dword [ebp - 0x100]
lea ecx, [ebp - 0x2b10]
call fcn.00431e5c
mov dword [eax], 0xb551fa4c
jmp 0x46ebb2
push 1
lea ecx, [ebp - 0x2b10]
call fcn.00431e5c
mov dword [ebp - 0xe34], eax
mov eax, dword [ebp - 0xe34]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xe34]
mov dword [ecx], eax
lea ecx, [ebp - 0x2b10]
call fcn.00431e40
jmp 0x46eb40
mov dword [ebp - 0x174], 0
jmp 0x46ec2e
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xffffffe7
je 0x46ed20
mov dword [ebp - 0x257c], 0x20f620a
mov dword [ebp - 0x1c88], 7
mov dword [ebp - 0x1c98], 0xfffffffc
mov dword [ebp - 0x2048], 0xfffffffe
mov dword [ebp - 0x1c88], 1
mov eax, dword [ebp - 0x257c]
cmp dword [ebp - 0x1c88], eax
je 0x46ec87
mov dword [ebp - 0xe3c], 1
jmp 0x46ec8e
and dword [ebp - 0xe3c], 0
cmp dword [ebp - 0xe3c], 0x91f3
jg 0x46eca6
mov dword [ebp - 0x1c90], 1
jmp 0x46ecad
and dword [ebp - 0x1c90], 0
cmp dword [ebp - 0x1c90], 0xa413
jg 0x46ecc5
mov dword [ebp - 0xe44], 1
jmp 0x46eccc
and dword [ebp - 0xe44], 0
mov eax, dword [ebp - 0xe44]
mov dword [ebp - 0x1c98], eax
cmp dword [ebp - 0x1c98], 0
jne 0x46ecf3
cmp dword [ebp - 0x2048], 0
jne 0x46ecf3
and dword [ebp - 0xe4c], 0
jmp 0x46ecfd
mov dword [ebp - 0xe4c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe4c]
mov dword [ebp + eax - 0x335c], ecx
cmp dword [ebp - 0x174], 0
je 0x46ed1b
jmp 0x46ed20
jmp 0x46ec21
mov dword [ebp - 0x50c], 0xffffffff
mov dword [ebp - 0x236c], 0x1d925b0e
mov dword [ebp - 0x1b0], 0xfff9
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0xe5c], 0x5fe46c2e
push 4
lea ecx, [ebp - 0x1fa8]
call fcn.00431d6e
push 4
lea ecx, [ebp - 0x2740]
call fcn.00431d6e
mov dword [ebp - 0x2058], 1
mov dword [ebp - 0x2374], 0xfffffffc
mov dword [ebp - 0x2060], 2
mov dword [ebp - 0x108], 0
jmp 0x46eda3
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x46edc2
push dword [ebp - 0x108]
lea ecx, [ebp - 0x1fa8]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x46ed96
mov dword [ebp - 0x108], 0
jmp 0x46eddb
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x46edfd
push dword [ebp - 0x108]
lea ecx, [ebp - 0x2740]
call fcn.00431e5c
mov dword [eax], 0x9646b8d9
jmp 0x46edce
mov eax, dword [ebp - 0x236c]
mov dword [ebp - 0x2050], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x2600], eax
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x2050]
cmp eax, dword [ebp - 0x2600]
jge 0x46ee3c
mov dword [ebp - 0x1cb8], 1
jmp 0x46ee43
and dword [ebp - 0x1cb8], 0
cmp dword [ebp - 0xe5c], 1
jge 0x46ee58
mov dword [ebp - 0x1ca0], 1
jmp 0x46ee5f
and dword [ebp - 0x1ca0], 0
push 0
lea ecx, [ebp - 0x1fa8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1ca0]
cmp ecx, dword [eax]
jg 0x46ee82
mov dword [ebp - 0xe54], 1
jmp 0x46ee89
and dword [ebp - 0xe54], 0
push 1
lea ecx, [ebp - 0x2740]
call fcn.00431e5c
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x8e4]
mov esi, dword [eax]
sub esi, dword [ebp - 0xe54]
push 0
lea ecx, [ebp - 0x1fa8]
call fcn.00431e5c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8e4]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x8e4]
mov dword [edx], ecx
cmp esi, eax
jne 0x46eed7
mov eax, 0x9f08664a
test eax, eax
jne 0x46eee9
cmp dword [ebp - 0x2058], 0
jne 0x46eee9
and dword [ebp - 0x1ca8], 0
jmp 0x46eef3
mov dword [ebp - 0x1ca8], 1
push 0
lea ecx, [ebp - 0x1fa8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1ca8]
cmp ecx, dword [eax]
jne 0x46ef16
mov dword [ebp - 0x1cb0], 1
jmp 0x46ef1d
and dword [ebp - 0x1cb0], 0
mov eax, dword [ebp - 0xe5c]
cmp dword [ebp - 0x1cb0], eax
jle 0x46ef37
mov dword [ebp - 0xe64], 1
jmp 0x46ef3e
and dword [ebp - 0xe64], 0
cmp dword [ebp - 0xe64], 0xffffffff
jb 0x46ef53
mov dword [ebp - 0xe6c], 1
jmp 0x46ef5a
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0x1cb8]
imul eax, dword [ebp - 0xe6c]
mov dword [ebp - 0x2374], eax
mov dword [ebp - 0x1b0], 0xfffffffa
jmp 0x46ef86
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x27
jle 0x46f15e
mov dword [ebp - 0x430], 0xd1aa12af
mov dword [ebp - 0xe74], 0
mov dword [ebp - 0x9a4], 0xa75015e0
cmp dword [ebp - 0x430], 0
je 0x46efbf
jmp 0x46f15e
xor eax, eax
inc eax
je 0x46f005
cmp dword [ebp - 0x430], 0x6ac116e0
je 0x46efdc
mov dword [ebp - 0x1cc0], 1
jmp 0x46efe3
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0x1cc0]
sub eax, dword [ebp - 0x430]
neg eax
mov dword [ebp - 0xe74], eax
je 0x46f005
mov dword [ebp - 0x1cc8], 1
jmp 0x46f00c
and dword [ebp - 0x1cc8], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x2c5c], eax
mov eax, dword [ebp - 0x1cc8]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x2c64], eax
mov eax, dword [ebp - 0x1b0]
inc eax
cmp dword [ebp - 0x430], eax
jg 0x46f051
cmp dword [ebp - 0x9a4], 0
jne 0x46f051
and dword [ebp - 0xe7c], 0
jmp 0x46f05b
mov dword [ebp - 0xe7c], 1
mov eax, dword [ebp - 0x2060]
cmp dword [ebp - 0xe7c], eax
jne 0x46f075
mov dword [ebp - 0x1cd0], 1
jmp 0x46f07c
and dword [ebp - 0x1cd0], 0
cmp dword [ebp - 0x1cd0], 0x9b41
jg 0x46f08d
xor eax, eax
inc eax
je 0x46f105
mov dword [ebp - 0x17c], 0x1c
jmp 0x46f0a6
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x1b
jl 0x46f0ef
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x46f0d5
push 0x1495
push 0
push 0x6ce
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
mov byte [ebp - 0x275], 0
movzx eax, byte [ebp - 0x275]
test eax, eax
je 0x46f0ed
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x46f099
push 2
lea ecx, [ebp - 0x2740]
call fcn.00431e5c
cmp dword [eax], 0
je 0x46f103
jmp 0x46f15e
jmp 0x46f159
mov dword [ebp - 0x17c], 0
jmp 0x46f11e
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 4
jge 0x46f13d
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x1fa8]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x46f111
mov byte [ebp - 0x254], 0
movzx eax, byte [ebp - 0x254]
test eax, eax
je 0x46f159
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
jmp 0x46ef79
lea ecx, [ebp - 0x2740]
call fcn.00431e40
lea ecx, [ebp - 0x1fa8]
call fcn.00431e40
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x2c6c], 0x9b642c70
mov dword [ebp - 0xe8c], 1
mov dword [ebp - 0x2584], 0x871d976f
mov dword [ebp - 0x2c74], 0xfe1ca296
mov dword [ebp - 0x1ce8], 0xe307b5ca
mov dword [ebp - 0x2c7c], 0x4185a1fa
push 2
lea ecx, [ebp - 0x2984]
call fcn.00431d6e
mov dword [ebp - 0x728], 0xffffffff
push 2
lea ecx, [ebp - 0x2a98]
call fcn.00431d6e
mov dword [ebp - 0x110], 0
jmp 0x46f1f7
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x46f219
push dword [ebp - 0x110]
lea ecx, [ebp - 0x2984]
call fcn.00431e5c
mov dword [eax], 0xbe39e3cf
jmp 0x46f1ea
mov dword [ebp - 0x110], 0
jmp 0x46f232
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x46f254
push dword [ebp - 0x110]
lea ecx, [ebp - 0x2a98]
call fcn.00431e5c
mov dword [eax], 0x34108fa7
jmp 0x46f225
mov eax, dword [ebp - 0x728]
inc eax
mov dword [ebp - 0x728], eax
cmp dword [ebp - 0xe8c], 0
jne 0x46f308
xor eax, eax
jne 0x46f308
imul eax, dword [ebp - 0x728], 0x2955
test eax, eax
je 0x46f299
cmp dword [ebp - 0x2584], 0
je 0x46f299
mov dword [ebp - 0xe84], 1
jmp 0x46f2a0
and dword [ebp - 0xe84], 0
push 1
lea ecx, [ebp - 0x2984]
call fcn.00431e5c
mov ecx, dword [ebp - 0xe84]
cmp ecx, dword [eax]
jne 0x46f2c3
mov dword [ebp - 0x1cd8], 1
jmp 0x46f2ca
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x1cd8]
shl eax, 3
cmp eax, dword [ebp - 0xe8c]
je 0x46f2e7
mov dword [ebp - 0x1ce0], 1
jmp 0x46f2ee
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x728]
add eax, dword [ebp - 0x1ce0]
cmp eax, 0xfffffff6
jne 0x46f308
and dword [ebp - 0xe94], 0
jmp 0x46f312
mov dword [ebp - 0xe94], 1
mov eax, dword [ebp - 0x1ce8]
add eax, dword [ebp - 0xe94]
jne 0x46f335
cmp dword [ebp - 0x1ce8], 0
jne 0x46f335
mov dword [ebp - 0xe9c], 1
jmp 0x46f33c
and dword [ebp - 0xe9c], 0
cmp dword [ebp - 0xe9c], 0x1181
jg 0x46f354
mov dword [ebp - 0x1cf0], 1
jmp 0x46f35b
and dword [ebp - 0x1cf0], 0
cmp dword [ebp - 0x1cf0], 0x4ce10b49
jne 0x46f373
mov dword [ebp - 0xea4], 1
jmp 0x46f37a
and dword [ebp - 0xea4], 0
push 0
lea ecx, [ebp - 0x2a98]
call fcn.00431e5c
mov ecx, dword [ebp - 0xea4]
mov dword [eax], ecx
lea ecx, [ebp - 0x2a98]
call fcn.00431e40
lea ecx, [ebp - 0x2984]
call fcn.00431e40
mov dword [ebp - 0x2108], 0
mov dword [ebp - 0x5d8], 0xb110c93b
mov dword [ebp - 0x2c84], 0xcb8e0045
push 4
lea ecx, [ebp - 0x3008]
call fcn.00431d6e
push 1
lea ecx, [ebp - 0x2990]
call fcn.00431d6e
mov dword [ebp - 0x2c8c], 0xf3bba68
mov dword [ebp - 0x237c], 0x80eb60f9
mov dword [ebp - 0x60], 0
jmp 0x46f401
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x46f417
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x3388], 0x1b870004
jmp 0x46f3fa
mov dword [ebp - 0x60], 0
jmp 0x46f427
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x46f440
push dword [ebp - 0x60]
lea ecx, [ebp - 0x3008]
call fcn.00431e5c
and dword [eax], 0
jmp 0x46f420
mov dword [ebp - 0x60], 0
jmp 0x46f450
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x46f469
push dword [ebp - 0x60]
lea ecx, [ebp - 0x2990]
call fcn.00431e5c
and dword [eax], 0
jmp 0x46f449
mov dword [ebp - 0x5d8], 0
jmp 0x46f482
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp dword [ebp - 0x5d8], 8
jg 0x46f4e9
mov dword [ebp - 0x2068], 0xfffffff9
cmp dword [ebp - 0x2068], 0
jle 0x46f4aa
mov dword [ebp - 0x1cf8], 1
jmp 0x46f4b1
and dword [ebp - 0x1cf8], 0
push 0
lea ecx, [ebp - 0x2990]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1cf8]
cmp ecx, dword [eax]
jge 0x46f4d4
mov dword [ebp - 0xeac], 1
jmp 0x46f4db
and dword [ebp - 0xeac], 0
mov eax, dword [ebp - 0xeac]
mov dword [ebp - 0x237c], eax
jmp 0x46f475
lea ecx, [ebp - 0x2990]
call fcn.00431e40
lea ecx, [ebp - 0x3008]
call fcn.00431e40
mov dword [ebp - 0x2120], 0xbe18a167
push 4
lea ecx, [ebp - 0x2478]
call fcn.00431d6e
mov dword [ebp - 0x2c94], 0
mov dword [ebp - 0x2658], 0
mov dword [ebp - 0x2070], 0xc87a7525
mov dword [ebp - 0x1d28], 0xfffffff8
mov dword [ebp - 0xc], 0
jmp 0x46f54e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x46f567
push dword [ebp - 0xc]
lea ecx, [ebp - 0x2478]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x46f547
mov dword [ebp - 0xc], 0
jmp 0x46f577
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x46f58d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x3238], 1
jmp 0x46f570
mov dword [ebp - 0xc], 0
jmp 0x46f59d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x46f5b3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x828], 0
jmp 0x46f596
mov dword [ebp - 0xc], 0
jmp 0x46f5c3
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x46f5d9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xeb4], 2
jmp 0x46f5bc
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x46f5f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
lea ecx, [ebp - 0x2478]
call fcn.00431e5c
mov dword [eax], 4
jmp 0x46f62a
push 2
lea ecx, [ebp - 0x2478]
call fcn.00431e5c
mov dword [ebp - 0x1d00], eax
mov eax, dword [ebp - 0x1d00]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1d00]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2478]
call fcn.00431e5c
cmp dword [eax], 0xfffffff5
jne 0x46f8ca
mov dword [ebp - 0x2c9c], 0xfffffffd
mov dword [ebp - 0x2ca4], 0xd658edfe
mov dword [ebp - 0xedc], 0xffffffff
mov dword [ebp - 0x2cac], 0xe13a6c9c
mov dword [ebp - 0x2cb4], 0xfbce008f
mov dword [ebp - 0x2cbc], 0xcf592758
mov dword [ebp - 0x184], 0
jmp 0x46f695
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x46f6b1
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x33d8], 0xa233
jmp 0x46f688
mov dword [ebp - 0x184], 0
jmp 0x46f6ca
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x46f6e6
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x3018], 0x1874da8
jmp 0x46f6bd
mov byte [ebp - 0x29c], 0
movzx eax, byte [ebp - 0x29c]
test eax, eax
je 0x46f706
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xeb4], 0x16765654
jg 0x46f725
mov dword [ebp - 0x1d18], 1
jmp 0x46f72c
and dword [ebp - 0x1d18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3018]
neg eax
je 0x46f7da
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xeb4]
cmp dword [ebp - 0x2070], eax
je 0x46f762
mov dword [ebp - 0x1d08], 1
jmp 0x46f769
and dword [ebp - 0x1d08], 0
cmp dword [ebp - 0x1d08], 8
jb 0x46f77e
mov dword [ebp - 0xebc], 1
jmp 0x46f785
and dword [ebp - 0xebc], 0
mov eax, dword [ebp - 0xebc]
add eax, 0xb040
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3018]
jge 0x46f7ab
mov dword [ebp - 0x1d10], 1
jmp 0x46f7b2
and dword [ebp - 0x1d10], 0
cmp dword [ebp - 0x1d10], 0xf914a126
jb 0x46f7c5
cmp dword [ebp - 0xedc], 0
cmp dword [ebp - 0x2658], 0
je 0x46f7da
mov dword [ebp - 0xec4], 1
jmp 0x46f7e1
and dword [ebp - 0xec4], 0
mov eax, dword [ebp - 0xec4]
sub eax, 0x9999
je 0x46f803
mov eax, 0x9f4802d1
test eax, eax
je 0x46f803
mov dword [ebp - 0xecc], 1
jmp 0x46f80a
and dword [ebp - 0xecc], 0
mov eax, dword [ebp - 0x1d18]
cmp eax, dword [ebp - 0xecc]
jle 0x46f824
mov dword [ebp - 0x1d20], 1
jmp 0x46f82b
and dword [ebp - 0x1d20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x828]
mov dword [ebp - 0x2078], eax
mov eax, dword [ebp - 0x1d20]
mov dword [ebp - 0x2384], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x828]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x828], eax
mov eax, dword [ebp - 0x2078]
cmp eax, dword [ebp - 0x2384]
je 0x46f87f
mov dword [ebp - 0x2080], 1
jmp 0x46f886
and dword [ebp - 0x2080], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x828]
mov dword [ebp - 0xed4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xed4]
mov dword [ebp + eax - 0x3238], ecx
mov eax, dword [ebp - 0xed4]
mov dword [ebp - 0x1d28], eax
imul eax, dword [ebp - 0x1d28], 0
mov dword [ebp - 0xedc], eax
jmp 0x46f606
lea ecx, [ebp - 0x2478]
call fcn.00431e40
mov dword [ebp - 0x17b0], 8
mov dword [ebp - 0x5e0], 0
jmp 0x46f8f8
mov eax, dword [ebp - 0x5e0]
inc eax
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 4
jge 0x46f914
mov eax, dword [ebp - 0x5e0]
mov dword [ebp + eax*4 - 0x3428], 0x971c1ec2
jmp 0x46f8eb
mov byte [ebp - 0x298], 0
movzx eax, byte [ebp - 0x298]
test eax, eax
je 0x46f946
push 0
push 0x1fe8
push 0
push 0x2240
push 0x1e67
push 0
push 0xc18
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3428], 0x91a049fe
mov dword [ebp - 0x2cc4], 0xffffffff
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x258c], 0x1c17c774
mov dword [ebp - 0x2090], 0x1a83
mov dword [ebp - 0x730], 0
jmp 0x46f99f
mov eax, dword [ebp - 0x730]
inc eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 2
jge 0x46f9bb
mov eax, dword [ebp - 0x730]
mov dword [ebp + eax*4 - 0x22cc], 0xfffffff8
jmp 0x46f992
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jle 0x46f9cf
mov dword [ebp - 0x1d30], 1
jmp 0x46f9d6
and dword [ebp - 0x1d30], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1d30], eax
je 0x46f9f1
mov dword [ebp - 0xee4], 1
jmp 0x46f9f8
and dword [ebp - 0xee4], 0
mov eax, dword [ebp - 0xee4]
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0xfff9
je 0x46fa25
cmp dword [ebp - 0x4fc], 0
je 0x46fa25
mov dword [ebp - 0x1d38], 1
jmp 0x46fa2c
and dword [ebp - 0x1d38], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x1d38]
mov dword [ebp - 0x258c], eax
cmp dword [ebp - 0x40], 0
jbe 0x46fa4e
mov dword [ebp - 0xeec], 1
jmp 0x46fa55
and dword [ebp - 0xeec], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xeec], eax
jl 0x46fa87
mov byte [ebp - 0x258], 0
movzx eax, byte [ebp - 0x258]
test eax, eax
je 0x46fa82
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x46fb44
mov dword [ebp - 0x40], 0
jmp 0x46fa97
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x46fb44
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x22cc], 0
jne 0x46fac7
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x22cc], 0x15d3
je 0x46fac7
and dword [ebp - 0x1d40], 0
jmp 0x46fad1
mov dword [ebp - 0x1d40], 1
cmp dword [ebp - 0x1d40], 0xb8f2ba16
jbe 0x46fae9
mov dword [ebp - 0xef4], 1
jmp 0x46faf0
and dword [ebp - 0xef4], 0
mov eax, dword [ebp - 0xef4]
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0
je 0x46fb1b
mov dword [ebp - 0x2088], 0xac89d73a
mov dword [ebp - 0x2088], 1
jmp 0x46fb2f
mov dword [ebp - 0x238c], 1
mov dword [ebp - 0x238c], 0xf3004570
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x2090]
mov dword [ebp + eax*4 - 0x22cc], ecx
jmp 0x46fa90
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x46fb5c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x1b1c], 0xfc51
mov dword [ebp - 0x2ccc], 1
mov dword [ebp - 0x2cd4], 0
push 2
lea ecx, [ebp - 0x2758]
call fcn.00431d6e
mov dword [ebp - 0xf0c], 0xffffffff
mov dword [ebp - 0x2608], 0x14d2fc5c
mov dword [ebp - 0x8ec], 3
mov dword [ebp - 0x20a0], 0
mov dword [ebp - 0x5e8], 0
jmp 0x46fbc8
mov eax, dword [ebp - 0x5e8]
inc eax
mov dword [ebp - 0x5e8], eax
cmp dword [ebp - 0x5e8], 2
jge 0x46fbe7
push dword [ebp - 0x5e8]
lea ecx, [ebp - 0x2758]
call fcn.00431e5c
and dword [eax], 0
jmp 0x46fbbb
push 0
lea ecx, [ebp - 0x2758]
call fcn.00431e5c
cmp dword [eax], 0x983ca307
jbe 0x46fc11
cmp dword [ebp - 0x2608], 0
je 0x46fc11
mov dword [ebp - 0x1d48], 1
jmp 0x46fc18
and dword [ebp - 0x1d48], 0
push 0
lea ecx, [ebp - 0x2758]
call fcn.00431e5c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1d48]
jg 0x46fc3b
mov dword [ebp - 0xefc], 1
jmp 0x46fc42
and dword [ebp - 0xefc], 0
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0x2098], eax
mov eax, dword [ebp - 0xefc]
mov dword [ebp - 0x2394], eax
mov eax, dword [ebp - 0x8ec]
dec eax
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x2098]
cmp eax, dword [ebp - 0x2394]
jg 0x46fc81
mov dword [ebp - 0x1d50], 1
jmp 0x46fc88
and dword [ebp - 0x1d50], 0
mov eax, dword [ebp - 0xf0c]
sub eax, 0x85869
cmp dword [ebp - 0x1d50], eax
je 0x46fca7
mov dword [ebp - 0xf04], 1
jmp 0x46fcae
and dword [ebp - 0xf04], 0
mov eax, dword [ebp - 0x20a0]
cmp dword [ebp - 0xf04], eax
je 0x46fcc8
mov dword [ebp - 0x1d58], 1
jmp 0x46fccf
and dword [ebp - 0x1d58], 0
mov eax, dword [ebp - 0x1d58]
mov dword [ebp - 0xf0c], eax
lea ecx, [ebp - 0x2758]
call fcn.00431e40
mov dword [ebp - 0x10c8], 0xc83be768
mov dword [ebp - 0x10], 0x28c1
push 1
lea ecx, [ebp - 0x1e68]
call fcn.00431d6e
push 1
lea ecx, [ebp - 0x2770]
call fcn.00431d6e
mov dword [ebp - 0x20b0], 0xfffffffa
mov dword [ebp - 0x118], 0
jmp 0x46fd34
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x46fd53
push dword [ebp - 0x118]
lea ecx, [ebp - 0x1e68]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x46fd27
mov dword [ebp - 0x118], 0
jmp 0x46fd6c
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x46fd8e
push dword [ebp - 0x118]
lea ecx, [ebp - 0x2770]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x46fd5f
cmp dword [ebp - 0x10], 0
je 0x46fdd2
mov byte [ebp - 0x25a], 0
movzx eax, byte [ebp - 0x25a]
test eax, eax
je 0x46fdb1
push 0x1154
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov byte [ebp - 0x29a], 0
movzx eax, byte [ebp - 0x29a]
test eax, eax
je 0x46fdcd
mov dword [ebp - 0xf1c], 0xfffffff8
mov dword [ebp - 0x2594], 0xfffffff9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2cdc], eax
cmp dword [ebp - 0xf1c], 0
jne 0x46fe0d
cmp dword [ebp - 0x10], 0
jne 0x46fe0d
mov dword [ebp - 0x1d60], 1
push 0
lea ecx, [ebp - 0x1e68]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1d60]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x1e68]
call fcn.00431e5c
cmp dword [eax], 0
je 0x46fe50
cmp dword [ebp + 8], 1
jne 0x47d61d
mov dword [ebp - 0x3210], 0
mov dword [ebp - 0x3218], 0xffffffff
mov dword [ebp - 0x3220], 0xa53aa9ac
mov dword [ebp - 0x3228], 6
mov dword [ebp - 0x1d8c], 0xb165
mov dword [ebp - 0x3230], 0xb3b7bede
mov dword [ebp - 0x323c], 0xffffffff
mov dword [ebp - 0x15f8], 0
mov dword [ebp - 0x56c], 0
jmp 0x47835a
mov eax, dword [ebp - 0x56c]
inc eax
mov dword [ebp - 0x56c], eax
cmp dword [ebp - 0x56c], 1
jge 0x478376
mov eax, dword [ebp - 0x56c]
mov dword [ebp + eax*4 - 0x3248], 0xfc3938dd
jmp 0x47834d
mov eax, dword [ebp - 0x1d8c]
inc eax
mov dword [ebp - 0x1d8c], eax
mov eax, dword [ebp - 0x15f8]
inc eax
mov dword [ebp - 0x15f8], eax
mov dword [ebp - 0x3250], 1
mov byte [ebp - 0x2c5], 0
movzx eax, byte [ebp - 0x2c5]
test eax, eax
je 0x4783b7
push 0x10ec
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov byte [ebp - 0x294], 0
movzx eax, byte [ebp - 0x294]
test eax, eax
je 0x4783db
push 0x13b9
push 0x2213
push 0
call dword [sym.imp.USER32.dll_InflateRect]
push 1
lea ecx, [ebp - 0x3088]
call fcn.00431d6e
mov dword [ebp - 0x2260], 1
mov dword [ebp - 0x248c], 0xffffffff
mov dword [ebp - 0x249c], 0x22354120
mov dword [ebp - 0x160], 0
jmp 0x47841f
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x478441
push dword [ebp - 0x160]
lea ecx, [ebp - 0x3088]
call fcn.00431e5c
mov dword [eax], 0xc176b0f7
jmp 0x478412
mov dword [ebp - 0x160], 0
jmp 0x47845a
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x478476
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x26bc], 0xffffffff
jmp 0x47844d
mov byte [ebp - 0x30d], 0
movzx eax, byte [ebp - 0x30d]
test eax, eax
je 0x478490
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x26bc], 0
jmp 0x4784be
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x26bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x26bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x26bc], 0
jg 0x4788e2
mov dword [ebp - 0x404], 0xb1658084
mov dword [ebp - 0x1610], 0xffffffff
push 2
lea ecx, [ebp - 0x2508]
call fcn.00431d6e
mov dword [ebp - 0x3258], 0x26a9
mov dword [ebp - 0x188], 0
jmp 0x478516
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x478538
push dword [ebp - 0x188]
lea ecx, [ebp - 0x2508]
call fcn.00431e5c
mov dword [eax], 0xd816f93b
jmp 0x478509
mov dword [ebp - 0x188], 0
jmp 0x478551
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x47856d
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x24f8], 0
jmp 0x478544
mov dword [ebp - 0x404], 0
jmp 0x478586
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
jg 0x4788d2
mov dword [ebp - 0x97c], 1
mov dword [ebp - 0x2590], 0xfffffff7
mov dword [ebp - 0x3260], 0x3b6f9b69
mov dword [ebp - 0x3268], 0xf9e3d3b
mov dword [ebp - 0x3270], 0
mov dword [ebp - 0x2bc8], 0
mov dword [ebp - 0x3280], 1
mov dword [ebp - 0x3288], 0xba2522ab
mov dword [ebp - 0x3290], 0x5a260df3
mov dword [ebp - 0x3298], 0xffffffff
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x32c4], 0xd06f6293
mov dword [ebp - 0x32cc], 7
push 3
lea ecx, [ebp - 0x2b04]
call fcn.00431d6e
mov dword [ebp - 0x2250], 0xb8161dbf
mov dword [ebp - 0x32d4], 0x2075
mov dword [ebp - 0x574], 0
jmp 0x47864f
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 3
jge 0x478671
push dword [ebp - 0x574]
lea ecx, [ebp - 0x2b04]
call fcn.00431e5c
mov dword [eax], 0xfffffffb
jmp 0x478642
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x32dc], eax
cmp dword [ebp - 0x97c], 1
jle 0x478692
mov dword [ebp - 0x1a48], 1
jmp 0x478699
and dword [ebp - 0x1a48], 0
mov eax, dword [ebp - 0x1a48]
sub eax, dword [ebp - 0x248c]
cmp eax, dword [ebp - 0x2250]
jg 0x4786b9
mov dword [ebp - 0x1600], 1
jmp 0x4786c0
and dword [ebp - 0x1600], 0
cmp dword [ebp - 0x1600], 4
jle 0x4786de
cmp dword [ebp - 0x404], 0
je 0x4786de
mov dword [ebp - 0x1c7c], 1
jmp 0x4786e5
and dword [ebp - 0x1c7c], 0
mov eax, dword [ebp - 0x1c7c]
sub eax, 7
mov dword [ebp - 0x2590], eax
push 1
lea ecx, [ebp - 0x2508]
call fcn.00431e5c
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x24f8]
cmp dword [eax], ecx
jg 0x47871d
mov dword [ebp - 0x1608], 1
jmp 0x478724
and dword [ebp - 0x1608], 0
cmp dword [ebp - 0x1608], 5
jl 0x478739
mov dword [ebp - 0x1a50], 1
jmp 0x478740
and dword [ebp - 0x1a50], 0
mov eax, dword [ebp - 0x1a50]
mov dword [ebp - 0x1610], eax
cmp dword [ebp - 0x1610], 0xc8a1
je 0x478764
mov dword [ebp - 0x1e5c], 1
jmp 0x47876b
and dword [ebp - 0x1e5c], 0
mov eax, dword [ebp - 0x97c]
cmp dword [ebp - 0x1e5c], eax
jl 0x478791
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x24f8], 0
jne 0x478791
cmp dword [ebp - 0x2258], 0
je 0x4787a6
mov eax, 0x67ee
test eax, eax
je 0x4787a6
mov dword [ebp - 0x1618], 1
jmp 0x4787ad
and dword [ebp - 0x1618], 0
cmp dword [ebp - 0x1618], 0x7411
je 0x4787c5
mov dword [ebp - 0xb40], 1
jmp 0x4787cc
and dword [ebp - 0xb40], 0
cmp dword [ebp - 0xb40], 0xfffffffa
jne 0x4787e1
mov dword [ebp - 0x1620], 1
jmp 0x4787e8
and dword [ebp - 0x1620], 0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x24f8]
push 1
lea ecx, [ebp - 0x2508]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1620]
sub ecx, dword [eax]
sub esi, ecx
push 4
pop eax
shl eax, 1
cmp esi, dword [ebp + eax - 0x24f8]
jl 0x478825
mov dword [ebp - 0x1c84], 1
jmp 0x47882c
and dword [ebp - 0x1c84], 0
mov eax, dword [ebp - 0x249c]
cmp dword [ebp - 0x1c84], eax
jge 0x478846
mov dword [ebp - 0x1628], 1
jmp 0x47884d
and dword [ebp - 0x1628], 0
cmp dword [ebp - 0x1628], 0xffffffff
jne 0x478862
mov dword [ebp - 0x1a60], 1
jmp 0x478869
and dword [ebp - 0x1a60], 0
mov esi, dword [ebp - 0x2260]
neg esi
push 4
pop eax
shl eax, 1
mov edi, dword [ebp + eax - 0x24f8]
push 2
lea ecx, [ebp - 0x2b04]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1a60]
imul ecx, dword [eax]
imul edi, ecx
cmp esi, edi
jl 0x4788a6
mov dword [ebp - 0x1630], 1
jmp 0x4788ad
and dword [ebp - 0x1630], 0
push 1
lea ecx, [ebp - 0x2508]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1630]
mov dword [eax], ecx
lea ecx, [ebp - 0x2b04]
call fcn.00431e40
jmp 0x478579
lea ecx, [ebp - 0x2508]
call fcn.00431e40
jmp 0x4784a3
lea ecx, [ebp - 0x3088]
call fcn.00431e40
mov dword [ebp - 0x1dac], 1
mov dword [ebp - 0xaf0], 0x82a1836c
mov dword [ebp - 0xaec], 0x82a1836c
mov dword [ebp - 0xae8], 0x82a1836c
mov dword [ebp - 0xae4], 0x82a1836c
mov dword [ebp - 0xe8], 0xffffffff
mov dword [ebp - 0xa34], 1
mov dword [ebp - 0x40c], 0x1bb000e2
mov dword [ebp - 0xbc], 0xa1a8f1ed
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xaf0]
cmp dword [ebp + eax - 0xaf0], ecx
jl 0x478a57
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xaf0], 0
je 0x478983
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xaf0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaf0]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0xaf0]
je 0x4789bf
mov eax, 0xfff8
test eax, eax
je 0x4789bf
mov dword [ebp - 0x1d94], 1
jmp 0x4789c6
and dword [ebp - 0x1d94], 0
imul eax, dword [ebp - 0x1d94], 0xffff
cmp eax, 0x98d7
jne 0x4789e9
cmp dword [ebp - 0xe8], 0
jne 0x4789e9
and dword [ebp - 0x1638], 0
jmp 0x4789f3
mov dword [ebp - 0x1638], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xaf0]
cmp dword [ebp - 0x1638], eax
jl 0x478a1c
mov eax, 0xf9150fae
test eax, eax
je 0x478a1c
mov dword [ebp - 0x2598], 1
jmp 0x478a23
and dword [ebp - 0x2598], 0
mov dword [ebp - 0xa34], 0x826f3938
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0xa34], 0
je 0x478a57
cmp dword [ebp - 0xe8], 0
je 0x478a57
mov dword [ebp - 0x1a68], 1
jmp 0x478a5e
and dword [ebp - 0x1a68], 0
cmp dword [ebp - 0x1a68], 0xd06ce125
jbe 0x478a76
mov dword [ebp - 0x1640], 1
jmp 0x478a7d
and dword [ebp - 0x1640], 0
mov eax, dword [ebp - 0x1640]
mov dword [ebp - 0xbc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xaf0], 0
je 0x478af7
mov dword [ebp - 0xbc], 3
jmp 0x478ab1
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x478af2
mov dword [ebp - 0xe8], 3
jmp 0x478ad3
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x478af0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0xaf0], 0
je 0x478aee
jmp 0x478af0
jmp 0x478ac6
jmp 0x478aa4
jmp 0x478b81
mov byte [ebp - 0x252], 0
movzx eax, byte [ebp - 0x252]
test eax, eax
je 0x478b27
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0xbc], 3
jmp 0x478b40
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x478b81
mov dword [ebp - 0x40c], 0
jmp 0x478b62
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 3
jg 0x478b7f
mov eax, dword [ebp - 0xbc]
cmp dword [ebp + eax*4 - 0xaf0], 0
je 0x478b7d
jmp 0x478b7f
jmp 0x478b55
jmp 0x478b33
mov dword [ebp - 0x24dc], 0
mov dword [ebp - 0x90], 5
push 3
lea ecx, [ebp - 0xa8c]
call fcn.00431d6e
mov dword [ebp - 0x414], 0x7008b15e
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x2268], 0xccc09984
mov dword [ebp - 0x1698], 0x6680214
mov dword [ebp - 0x25a0], 0xfffffffe
mov dword [ebp - 0x32e8], 0xfffffffd
mov dword [ebp - 0x32f0], 0xdd081fb7
mov dword [ebp - 0x32f8], 0x582d056b
mov dword [ebp - 0x3300], 0x86fd7422
mov dword [ebp - 0x3308], 0x42336f7e
mov dword [ebp - 0x2280], 0xffffffff
mov dword [ebp - 0x3310], 0x28409d7f
mov dword [ebp - 0x32fc], 0x1ef36a5f
mov dword [ebp - 0x31d4], 1
mov dword [ebp - 0x24ac], 0x5566ec8b
mov dword [ebp - 0x3c], 0
jmp 0x478c48
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x478c61
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
and dword [eax], 0
jmp 0x478c41
mov dword [ebp - 0x3c], 0
jmp 0x478c71
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x478c87
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x30e4], 0xfffffff7
jmp 0x478c6a
mov dword [ebp - 0x3c], 0
jmp 0x478c97
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x478cad
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2e90], 0x9f073e42
jmp 0x478c90
mov byte [ebp - 0x22e], 0
movzx eax, byte [ebp - 0x22e]
test eax, eax
je 0x478cc5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jne 0x478de9
cmp dword [ebp - 0x90], 0
jne 0x478de9
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x2ecc], eax
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
mov ecx, dword [ebp - 0x90]
cmp dword [eax], ecx
jg 0x478d13
mov dword [ebp - 0x1c8c], 1
jmp 0x478d1a
and dword [ebp - 0x1c8c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1c8c], eax
jl 0x478d34
mov dword [ebp - 0x1648], 1
jmp 0x478d3b
and dword [ebp - 0x1648], 0
mov eax, dword [ebp - 0x1648]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0
je 0x478d6e
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
cmp dword [eax], 0
je 0x478d6e
mov dword [ebp - 0x1a70], 1
jmp 0x478d75
and dword [ebp - 0x1a70], 0
cmp dword [ebp - 0x1a70], 1
je 0x478d8a
mov dword [ebp - 0x1650], 1
jmp 0x478d91
and dword [ebp - 0x1650], 0
mov eax, dword [ebp - 0x1650]
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0xfffffff6
jge 0x478db2
mov dword [ebp - 0x1e1c], 1
jmp 0x478db9
and dword [ebp - 0x1e1c], 0
push 2
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1e1c]
cmp ecx, dword [eax]
jl 0x478ddc
mov dword [ebp - 0x1658], 1
jmp 0x478de3
and dword [ebp - 0x1658], 0
mov eax, dword [ebp - 0x90]
mov eax, 0x787d6364
add eax, 9
je 0x4790cc
cmp dword [ebp - 0x594], 0
je 0x4790cc
mov dword [ebp - 0x584], 0xe617
mov dword [ebp - 0x1680], 0x9a2dd318
mov dword [ebp - 0x90], 0x12
jmp 0x478e31
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 6
jne 0x4790c7
push 3
lea ecx, [ebp - 0xaa4]
call fcn.00431d6e
mov dword [ebp - 0x1a78], 1
mov dword [ebp - 0x1670], 0xfffffffd
mov dword [ebp - 0x57c], 0
jmp 0x478e78
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 3
jge 0x478e9a
push dword [ebp - 0x57c]
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
mov dword [eax], 0xf0c3
jmp 0x478e6b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30e4]
mov dword [ebp - 0x2bd0], eax
push 0
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x478f98
mov dword [ebp - 0x414], 1
cmp dword [ebp - 0x414], 0
jne 0x478ee3
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
mov eax, dword [eax]
add eax, dword [ebp - 0x584]
imul eax, eax, 0xff82
mov dword [ebp - 0x1a78], eax
mov eax, dword [ebp - 0x1a78]
mov dword [ebp - 0x325c], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x2bd8], eax
mov esi, 0x15a0349b
add esi, 0x5b04ce9d
push 0
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
sub esi, dword [eax]
sub esi, dword [ebp - 0x584]
push 1
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
sub esi, dword [eax]
je 0x478f6b
push 1
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
cmp dword [eax], 0
je 0x478f6b
mov dword [ebp - 0x1660], 1
jmp 0x478f72
and dword [ebp - 0x1660], 0
mov esi, dword [ebp - 0x90]
add esi, dword [ebp - 0x1660]
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
cmp esi, dword [eax]
jl 0x478f98
and dword [ebp - 0x1c94], 0
jmp 0x478fa2
mov dword [ebp - 0x1c94], 1
push 0
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
mov esi, dword [ebp - 0x1c94]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
imul esi, dword [eax]
test esi, esi
je 0x478fe1
mov eax, 0x4e6a
test eax, eax
je 0x478fe1
mov dword [ebp - 0x1668], 1
jmp 0x478fe8
and dword [ebp - 0x1668], 0
cmp dword [ebp - 0x1668], 0x9d7f
jg 0x479000
mov dword [ebp - 0x1a80], 1
jmp 0x479007
and dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0x1a80]
mov dword [ebp - 0x1670], eax
mov esi, dword [ebp - 0x2268]
add esi, dword [ebp - 0x1670]
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
cmp dword [eax], esi
jge 0x47903c
mov dword [ebp - 0x1d9c], 1
jmp 0x479043
and dword [ebp - 0x1d9c], 0
cmp dword [ebp - 0x1d9c], 0
je 0x47905e
cmp dword [ebp - 0x584], 0
jne 0x47905e
and dword [ebp - 0x1678], 0
jmp 0x479068
mov dword [ebp - 0x1678], 1
push 0
lea ecx, [ebp - 0xaa4]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1678]
cmp ecx, dword [eax]
jg 0x47908b
mov dword [ebp - 0x1a88], 1
jmp 0x479092
and dword [ebp - 0x1a88], 0
mov eax, dword [ebp - 0x1a88]
mov dword [ebp - 0x1680], eax
cmp dword [ebp - 0x1680], 0
je 0x4790b7
lea ecx, [ebp - 0xaa4]
call fcn.00431e40
jmp 0x478e24
lea ecx, [ebp - 0xaa4]
call fcn.00431e40
jmp 0x478e24
jmp 0x4792e1
and dword [ebp - 0x28a4], 0
and dword [ebp - 0x28a0], 0
and dword [ebp - 0x289c], 0
and dword [ebp - 0x2898], 0
lea ecx, [ebp - 0xa21]
call fcn.00431e6b
push eax
lea eax, [ebp - 0x2894]
push eax
lea eax, [ebp - 0x28a4]
push eax
lea ecx, [ebp - 0x33a8]
call fcn.00431e6e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x277c]
call fcn.00431e1a
mov dword [ebp - 0x24bc], 0x54637542
mov dword [ebp - 0x2f0c], 0xbeb03c75
mov dword [ebp - 0x2270], 1
mov dword [ebp - 0x58c], 0
jmp 0x479154
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 1
jge 0x479170
mov eax, dword [ebp - 0x58c]
mov dword [ebp + eax*4 - 0x2be0], 0x44e4153c
jmp 0x479147
cmp dword [ebp - 0x24ac], 0
je 0x47918c
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x47918c
mov dword [ebp - 0x1c9c], 1
jmp 0x479193
and dword [ebp - 0x1c9c], 0
mov eax, dword [ebp - 0x2270]
cmp dword [ebp - 0x1c9c], eax
jle 0x4791ad
mov dword [ebp - 0x1688], 1
jmp 0x4791b4
and dword [ebp - 0x1688], 0
push 0
lea ecx, [ebp - 0xa8c]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1688]
cmp ecx, dword [eax]
jle 0x4791d7
mov dword [ebp - 0x1a90], 1
jmp 0x4791de
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x1a90]
jne 0x479210
push 0
lea ecx, [ebp - 0x277c]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x479210
cmp dword [ebp - 0x25a0], 0
jne 0x479210
and dword [ebp - 0x1690], 0
jmp 0x47921a
mov dword [ebp - 0x1690], 1
cmp dword [ebp - 0x1690], 0
jne 0x47922f
mov dword [ebp - 0x1eac], 1
jmp 0x479236
and dword [ebp - 0x1eac], 0
mov eax, dword [ebp - 0x1eac]
mov dword [ebp - 0x1698], eax
mov esi, dword [ebp - 0x1698]
push 3
lea ecx, [ebp - 0x277c]
call fcn.00431e5c
cmp dword [eax], esi
jg 0x479265
mov dword [ebp - 0x2278], 1
jmp 0x47926c
and dword [ebp - 0x2278], 0
push 3
lea ecx, [ebp - 0x277c]
call fcn.00431e5c
cmp dword [eax], 1
jl 0x47928a
mov dword [ebp - 0x1a98], 1
jmp 0x479291
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0x24bc]
imul eax, dword [ebp - 0x1a98]
cmp eax, dword [ebp - 0x594]
jne 0x4792b2
mov dword [ebp - 0x16a0], 1
jmp 0x4792b9
and dword [ebp - 0x16a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e90]
mov ecx, dword [ebp - 0x16a0]
lea eax, [ecx + eax - 7]
mov dword [ebp - 0x2280], eax
lea ecx, [ebp - 0x277c]
call fcn.00431e40
lea ecx, [ebp - 0xa8c]
call fcn.00431e40
mov dword [ebp - 0xf60], 0xfffffff7
mov dword [ebp - 0x208], 1
push 4
lea ecx, [ebp - 0x26d4]
call fcn.00431d6e
mov dword [ebp - 0x59c], 0
jmp 0x479326
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 4
jge 0x479348
push dword [ebp - 0x59c]
lea ecx, [ebp - 0x26d4]
call fcn.00431e5c
mov dword [eax], 0xc7bf
jmp 0x479319
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x208], 3
jmp 0x47936d
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x4793ed
mov dword [ebp - 0x5a4], 0x50e6da50
mov byte [ebp - 0x230], 0
movzx eax, byte [ebp - 0x230]
test eax, eax
je 0x47939c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x5a4], 0
jmp 0x4793b5
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 3
jg 0x4793e8
push dword [ebp - 0x208]
lea ecx, [ebp - 0x26d4]
call fcn.00431e5c
mov esi, eax
push dword [ebp - 0x208]
lea ecx, [ebp - 0x26d4]
call fcn.00431e5c
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x4793a8
jmp 0x479360
lea ecx, [ebp - 0x26d4]
call fcn.00431e40
push 2
lea ecx, [ebp - 0x2794]
call fcn.00431d6e
mov dword [ebp - 0x315c], 0x1a7a
mov dword [ebp - 0x2be8], 0x44555950
mov dword [ebp - 0x168], 0
jmp 0x479432
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x47944e
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x1fcc], 1
jmp 0x479425
mov dword [ebp - 0x168], 0
jmp 0x479467
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x479483
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x884], 1
jmp 0x47945a
mov byte [ebp - 0x232], 0
movzx eax, byte [ebp - 0x232]
test eax, eax
je 0x47949d
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x884], 0
jmp 0x4794cb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x884]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x884], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x884], 2
jg 0x479755
mov dword [ebp - 0x16a8], 0x94ff5452
mov dword [ebp - 0x1aa8], 0xf15c
mov dword [ebp - 0x5ac], 0
jmp 0x47950c
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 2
jge 0x479528
mov eax, dword [ebp - 0x5ac]
mov dword [ebp + eax*4 - 0xac8], 0xffffffff
jmp 0x4794ff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xac8], 0
jmp 0x479556
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xac8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xac8], 2
jg 0x479750
mov dword [ebp - 0x2fc], 0xdbda
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2fc], 0
jmp 0x47959a
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 2
jg 0x47974b
mov dword [ebp - 0x1cac], 0x271dbca
mov dword [ebp - 0x25a8], 0xb8cff26a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac8]
cmp dword [ebp + eax*4 - 0x1fcc], 0
je 0x479733
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xac8]
mov eax, dword [ebp + eax*4 - 0x1fcc]
mov dword [ebp - 0x2f14], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x884]
cmp dword [ebp + eax*4 - 0x1fcc], 0xddae
jl 0x479616
mov dword [ebp - 0x1ca4], 1
jmp 0x47961d
and dword [ebp - 0x1ca4], 0
mov eax, dword [ebp - 0x1ca4]
mov dword [ebp - 0x16a8], eax
mov eax, dword [ebp - 0x16a8]
dec eax
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x884]
cmp dword [ebp + ecx*4 - 0x1fcc], eax
jg 0x47965b
mov eax, 0x3813bf58
test eax, eax
je 0x47965b
mov dword [ebp - 0x1aa0], 1
jmp 0x479662
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x1aa0], eax
jg 0x47967c
mov dword [ebp - 0x16b0], 1
jmp 0x479683
and dword [ebp - 0x16b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x884]
mov eax, dword [ebp + eax*4 - 0x1fcc]
cmp eax, dword [ebp - 0x16b0]
je 0x4796ab
mov dword [ebp - 0x1da4], 1
jmp 0x4796b2
and dword [ebp - 0x1da4], 0
mov eax, dword [ebp - 0x1da4]
inc eax
inc eax
mov dword [ebp - 0x16b8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x884]
mov ecx, dword [ebp - 0x16b8]
mov dword [ebp + eax*4 - 0x1fcc], ecx
mov eax, dword [ebp - 0x16b8]
mov dword [ebp - 0x1aa8], eax
cmp dword [ebp - 0x1aa8], 0
jne 0x479708
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x884], 0
jne 0x479708
and dword [ebp - 0x16c0], 0
jmp 0x479712
mov dword [ebp - 0x16c0], 1
mov eax, dword [ebp - 0x16c0]
mov dword [ebp - 0x1cac], eax
cmp dword [ebp - 0x1cac], 0
je 0x479733
mov dword [ebp - 0x16c8], 1
jmp 0x47973a
and dword [ebp - 0x16c8], 0
mov eax, dword [ebp - 0x16c8]
mov dword [ebp - 0x25a8], eax
jmp 0x47958d
jmp 0x47953b
jmp 0x4794b0
mov dword [ebp - 0x25b8], 1
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x1ab0], 0xe2c0d37a
mov dword [ebp - 0x41c], 0
jmp 0x47978c
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x19
je 0x4797d4
mov dword [ebp - 0x2288], 0xdcb363f9
mov eax, dword [ebp - 0x41c]
add eax, 7
mov dword [ebp - 0x1ab0], eax
mov eax, dword [ebp - 0x1ab0]
mov dword [ebp - 0x2288], eax
mov byte [ebp - 0x234], 0
movzx eax, byte [ebp - 0x234]
test eax, eax
je 0x4797d2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x47977f
mov dword [ebp - 0x22a0], 0
mov dword [ebp - 0x984], 1
mov dword [ebp - 0x5bc], 0xffffffff
push 3
lea ecx, [ebp - 0x27dc]
call fcn.00431d6e
mov dword [ebp - 0x24cc], 0x98815cbc
mov dword [ebp - 0x5b4], 0
jmp 0x479822
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 3
jge 0x479844
push dword [ebp - 0x5b4]
lea ecx, [ebp - 0x27dc]
call fcn.00431e5c
mov dword [eax], 0x94a18885
jmp 0x479815
mov dword [ebp - 0x5bc], 0
jmp 0x47985d
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0x19
je 0x4799c0
mov dword [ebp - 0x28cc], 0x6e60b0ce
mov dword [ebp - 0x28c8], 0x6e60b0ce
mov dword [ebp - 0x28c4], 0x6e60b0ce
mov dword [ebp - 0x28c0], 0x6e60b0ce
lea ecx, [ebp - 0x8cd]
call fcn.00431e6b
push eax
lea eax, [ebp - 0x28bc]
push eax
lea eax, [ebp - 0x28cc]
push eax
lea ecx, [ebp - 0x33b0]
call fcn.00431e6e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb3c]
call fcn.00431e1a
mov dword [ebp - 0x2290], 0xdda37bb0
push 1
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
mov dword [eax], 2
jmp 0x47990a
push 1
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
mov dword [ebp - 0x16d0], eax
mov eax, dword [ebp - 0x16d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x16d0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
cmp dword [eax], 0
jl 0x479978
push 1
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
push dword [eax]
lea ecx, [ebp - 0x27dc]
call fcn.00431e5c
mov esi, eax
push 1
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
push dword [eax]
lea ecx, [ebp - 0x27dc]
call fcn.00431e5c
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0x24cc], ecx
push 1
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
cmp dword [eax], 0
je 0x479973
jmp 0x4798e6
jmp 0x4798e6
push 3
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
mov dword [ebp - 0x1e24], eax
push 3
lea ecx, [ebp - 0xb3c]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1e24]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1e24]
mov eax, dword [eax]
mov dword [ebp - 0x2290], eax
lea ecx, [ebp - 0xb3c]
call fcn.00431e40
jmp 0x479850
lea ecx, [ebp - 0x27dc]
call fcn.00431e40
mov dword [ebp - 0x1e8], 0x29bf390
mov dword [ebp - 0x304], 0xde9bf9f
mov dword [ebp - 0x2298], 0x834ab462
mov dword [ebp - 0x5c4], 0
jmp 0x479a02
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 2
jge 0x479a1e
mov eax, dword [ebp - 0x5c4]
mov dword [ebp + eax*4 - 0x3244], 1
jmp 0x4799f5
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x2bf0], eax
cmp dword [ebp - 0x304], 1
jge 0x479a4b
mov dword [ebp - 0x16d8], 1
jmp 0x479a52
and dword [ebp - 0x16d8], 0
mov eax, dword [ebp - 0x16d8]
add eax, 0x6d08
cmp eax, dword [ebp - 0x1e8]
je 0x479a71
mov dword [ebp - 0x1ab8], 1
jmp 0x479a78
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x1ab8], eax
jl 0x479a92
mov dword [ebp - 0x16e0], 1
jmp 0x479a99
and dword [ebp - 0x16e0], 0
mov eax, dword [ebp - 0x16e0]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
add eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x1e8]
jge 0x479ac5
mov dword [ebp - 0x1cb4], 1
jmp 0x479acc
and dword [ebp - 0x1cb4], 0
cmp dword [ebp - 0x1cb4], 0xc65b
je 0x479ae8
push 2
pop eax
test eax, eax
jne 0x479ae8
and dword [ebp - 0x16e8], 0
jmp 0x479af2
mov dword [ebp - 0x16e8], 1
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x16e8], eax
jge 0x479b0c
mov dword [ebp - 0x1ac0], 1
jmp 0x479b13
and dword [ebp - 0x1ac0], 0
mov eax, dword [ebp - 0x1e8]
imul eax, dword [ebp - 0x1ac0]
cmp dword [ebp - 0x1e8], eax
jne 0x479b34
mov dword [ebp - 0x25b0], 1
jmp 0x479b3b
and dword [ebp - 0x25b0], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x32c0], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x16f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x16f0]
mov dword [ebp + eax - 0x3244], ecx
mov eax, dword [ebp - 0x16f0]
mov dword [ebp - 0x2298], eax
mov byte [ebp - 0x236], 0
movzx eax, byte [ebp - 0x236]
test eax, eax
je 0x479b8f
push 0x2173
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x5cc], 0
jmp 0x479ba8
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 2
jge 0x479bca
push dword [ebp - 0x5cc]
lea ecx, [ebp - 0x2794]
call fcn.00431e5c
mov dword [eax], 0xadb2bc40
jmp 0x479b9b
push 1
lea ecx, [ebp - 0x26ec]
call fcn.00431d6e
mov dword [ebp - 0x37c], 0xe83c773
mov dword [ebp - 0x5d4], 0
jmp 0x479bfa
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 1
jge 0x479c1c
push dword [ebp - 0x5d4]
lea ecx, [ebp - 0x26ec]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x479bed
mov dword [ebp - 0x37c], 0
jmp 0x479c35
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 1
jge 0x479c57
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x26ec]
call fcn.00431e5c
mov dword [eax], 0x94f3
jmp 0x479c28
push 0
lea ecx, [ebp - 0x26ec]
call fcn.00431e5c
mov eax, dword [eax]
mov dword [ebp - 0x37c], eax
lea ecx, [ebp - 0x26ec]
call fcn.00431e40
mov eax, dword [ebp - 0x1dac]
cmp dword [ebp - 0x1dac], eax
jle 0x479c91
mov dword [ebp - 0x16f8], 1
jmp 0x479c98
and dword [ebp - 0x16f8], 0
mov eax, dword [ebp - 0x16f8]
mov dword [ebp - 0x24dc], eax
cmp dword [ebp - 0xf60], 0
jne 0x479cd7
mov eax, dword [ebp - 0x984]
imul eax, dword [ebp - 0x22a0]
mov ecx, dword [ebp - 0x984]
inc ecx
mov dword [ebp - 0x984], ecx
test eax, eax
je 0x479cd7
mov dword [ebp - 0xf6c], 1
jmp 0x479cde
and dword [ebp - 0xf6c], 0
cmp dword [ebp - 0xf60], 1
jg 0x479cf3
mov dword [ebp - 0xf64], 1
jmp 0x479cfa
and dword [ebp - 0xf64], 0
mov eax, dword [ebp - 0x25b8]
cmp dword [ebp - 0xf64], eax
jl 0x479d14
mov dword [ebp - 0xf74], 1
jmp 0x479d1b
and dword [ebp - 0xf74], 0
mov eax, dword [ebp - 0xf6c]
add eax, dword [ebp - 0xf74]
cmp eax, 0xe45db0ff
je 0x479d3a
mov dword [ebp - 0xf7c], 1
jmp 0x479d41
and dword [ebp - 0xf7c], 0
push 0
lea ecx, [ebp - 0x2794]
call fcn.00431e5c
mov ecx, dword [ebp - 0xf7c]
cmp ecx, dword [eax]
jge 0x479d64
mov dword [ebp - 0xf84], 1
jmp 0x479d6b
and dword [ebp - 0xf84], 0
push 0
lea ecx, [ebp - 0x2794]
call fcn.00431e5c
mov ecx, dword [ebp - 0xf84]
mov dword [eax], ecx
lea ecx, [ebp - 0x2794]
call fcn.00431e40
push 4
lea ecx, [ebp - 0x2524]
call fcn.00431d6e
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x24ec], 0x55ebda18
mov dword [ebp - 0x52c], 0
jmp 0x479dc5
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 4
jge 0x479de7
push dword [ebp - 0x52c]
lea ecx, [ebp - 0x2524]
call fcn.00431e5c
mov dword [eax], 0xfffffff6
jmp 0x479db8
mov dword [ebp - 0x424], 3
jmp 0x479e00
mov eax, dword [ebp - 0x424]
dec eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
jl 0x479fa2
mov dword [ebp - 0xc4], 0x3efc07e1
mov dword [ebp - 0x22ac], 0xa82e77e8
mov byte [ebp - 0x238], 0
movzx eax, byte [ebp - 0x238]
test eax, eax
je 0x479e50
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0
push 0x1b35
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov dword [ebp - 0xc4], 0
jmp 0x479e69
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x479f9d
cmp dword [ebp - 0xc4], 0
je 0x479ea1
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x2524]
call fcn.00431e5c
cmp dword [eax], 0
je 0x479ea1
mov dword [ebp - 0xf8c], 1
jmp 0x479ea8
and dword [ebp - 0xf8c], 0
xor eax, eax
sub eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc4]
jl 0x479ec4
mov dword [ebp - 0xf94], 1
jmp 0x479ecb
and dword [ebp - 0xf94], 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x2524]
call fcn.00431e5c
mov eax, dword [eax]
cmp eax, dword [ebp - 0xf94]
jg 0x479ef2
mov dword [ebp - 0xf9c], 1
jmp 0x479ef9
and dword [ebp - 0xf9c], 0
mov eax, dword [ebp - 0x424]
cmp dword [ebp - 0xf9c], eax
jl 0x479f13
mov dword [ebp - 0xfa4], 1
jmp 0x479f1a
and dword [ebp - 0xfa4], 0
cmp dword [ebp - 0xfa4], 0x9e672ca3
jb 0x479f32
mov dword [ebp - 0xfac], 1
jmp 0x479f39
and dword [ebp - 0xfac], 0
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x2524]
call fcn.00431e5c
mov ecx, dword [ebp - 0xfac]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x22ac]
jne 0x479f66
mov dword [ebp - 0xfb4], 1
jmp 0x479f6d
and dword [ebp - 0xfb4], 0
mov eax, dword [ebp - 0xfb4]
mov dword [ebp - 0x24ec], eax
mov byte [ebp - 0x23a], 0
movzx eax, byte [ebp - 0x23a]
test eax, eax
je 0x479f98
push 0
push 0xba
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x479e5c
jmp 0x479df3
lea ecx, [ebp - 0x2524]
call fcn.00431e40
call fcn.004681f1
mov dword [ebp - 0x30c], 1
push 1
lea ecx, [ebp - 0x2b1c]
call fcn.00431d6e
mov dword [ebp - 0x2bf8], 0xcb03629a
mov dword [ebp - 0x5dc], 0
jmp 0x479fec
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 1
jge 0x47a00e
push dword [ebp - 0x5dc]
lea ecx, [ebp - 0x2b1c]
call fcn.00431e5c
mov dword [eax], 0x288a137b
jmp 0x479fdf
cmp dword [ebp - 0x30c], 3
je 0x47a023
mov dword [ebp - 0xfbc], 1
jmp 0x47a02a
and dword [ebp - 0xfbc], 0
mov eax, dword [ebp - 0xfbc]
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x30c], 0
jmp 0x47a04f
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x47a071
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x2b1c]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x47a042
lea ecx, [ebp - 0x2b1c]
call fcn.00431e40
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x384], 0xfffffff9
mov dword [ebp - 0x228], 0xfffffff8
mov dword [ebp - 0x8ac], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x47a0bd
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xc
je 0x47a5c8
mov dword [ebp - 0x20], 0x23ed15de
mov dword [ebp - 0x1edc], 0
mov dword [ebp - 0x1ed8], 0
mov dword [ebp - 0x1ed4], 0
mov dword [ebp - 0x1ed0], 0
mov dword [ebp - 0x104c], 0x83830386
mov dword [ebp - 0x25c0], 0
cmp dword [ebp - 0xcc], 0
jne 0x47a177
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jl 0x47a12d
cmp dword [ebp - 0x20], 0
jne 0x47a12d
and dword [ebp - 0xf5c], 0
jmp 0x47a137
mov dword [ebp - 0xf5c], 1
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0xf5c]
add eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x20]
je 0x47a15a
mov dword [ebp - 0x22b8], 1
jmp 0x47a161
and dword [ebp - 0x22b8], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2f1c], eax
cmp dword [ebp - 0x384], 0
je 0x47a241
mov dword [ebp - 0x1a8], 0
jmp 0x47a190
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x47a1ac
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x33f0], 2
jmp 0x47a183
mov dword [ebp - 0x1a8], 0
jmp 0x47a1c5
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x47a1e1
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x3400], 0x9a9b
jmp 0x47a1b8
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x2c00], eax
cmp dword [ebp - 0x20], 1
jle 0x47a205
cmp dword [ebp - 0x20], 0
je 0x47a205
mov dword [ebp - 0xf58], 1
jmp 0x47a20c
and dword [ebp - 0xf58], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf58]
mov dword [ebp + eax - 0x3400], ecx
mov byte [ebp - 0x23c], 0
movzx eax, byte [ebp - 0x23c]
test eax, eax
je 0x47a23c
push 0x9d9
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x47a5c3
mov dword [ebp - 0x100c], 0x552d
mov dword [ebp - 0xff4], 0x5d482642
mov dword [ebp - 0x384], 0
jmp 0x47a26e
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 3
jg 0x47a5c3
push 2
lea ecx, [ebp - 0x2704]
call fcn.00431d6e
mov dword [ebp - 0x5e4], 0
jmp 0x47a2a1
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 2
jge 0x47a2c3
push dword [ebp - 0x5e4]
lea ecx, [ebp - 0x2704]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x47a294
mov dword [ebp - 0x20], 0
jmp 0x47a2d3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x47a5b3
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1edc], 0
jne 0x47a3a7
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
jne 0x47a384
cmp dword [ebp - 0xff4], 0
jne 0x47a341
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1edc], 0xffffffff
jne 0x47a325
mov dword [ebp - 0xfd4], 1
jmp 0x47a32c
and dword [ebp - 0xfd4], 0
cmp dword [ebp - 0xfd4], 0xb93b3bbb
ja 0x47a341
and dword [ebp - 0xfdc], 0
jmp 0x47a34b
mov dword [ebp - 0xfdc], 1
mov eax, dword [ebp - 0xfdc]
dec eax
cmp eax, dword [ebp - 0xcc]
jge 0x47a366
mov dword [ebp - 0xfe4], 1
jmp 0x47a36d
and dword [ebp - 0xfe4], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xfe4], eax
jle 0x47a384
and dword [ebp - 0xfec], 0
jmp 0x47a38e
mov dword [ebp - 0xfec], 1
mov eax, dword [ebp - 0xfec]
neg eax
cmp eax, dword [ebp - 0xff4]
jge 0x47a3a7
and dword [ebp - 0xffc], 0
jmp 0x47a3b1
mov dword [ebp - 0xffc], 1
mov eax, dword [ebp - 0x100c]
cmp dword [ebp - 0xffc], eax
jl 0x47a3cb
mov dword [ebp - 0x1004], 1
jmp 0x47a3d2
and dword [ebp - 0x1004], 0
cmp dword [ebp - 0x1004], 0x2c3cc8c9
jge 0x47a3f7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1edc], 0
jne 0x47a3f7
and dword [ebp - 0x1014], 0
jmp 0x47a401
mov dword [ebp - 0x1014], 1
mov eax, dword [ebp - 0x100c]
cmp eax, dword [ebp - 0x1014]
jge 0x47a41b
mov dword [ebp - 0x101c], 1
jmp 0x47a422
and dword [ebp - 0x101c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1edc]
cmp dword [ebp - 0x101c], eax
jge 0x47a443
mov dword [ebp - 0x1024], 1
jmp 0x47a44a
and dword [ebp - 0x1024], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1edc]
cmp dword [ebp - 0x1024], eax
jl 0x47a468
mov dword [ebp - 0x102c], 1
jmp 0x47a46f
and dword [ebp - 0x102c], 0
mov eax, dword [ebp - 0x102c]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x8ac], eax
jl 0x47a495
mov dword [ebp - 0x1034], 1
jmp 0x47a49c
and dword [ebp - 0x1034], 0
imul eax, dword [ebp - 0x1034], 0
test eax, eax
je 0x47a4b9
cmp dword [ebp - 0x20], 0
je 0x47a4b9
mov dword [ebp - 0x103c], 1
jmp 0x47a4c0
and dword [ebp - 0x103c], 0
push 1
lea ecx, [ebp - 0x2704]
call fcn.00431e5c
mov ecx, dword [ebp - 0x103c]
cmp ecx, dword [eax]
je 0x47a4e3
mov dword [ebp - 0x1044], 1
jmp 0x47a4ea
and dword [ebp - 0x1044], 0
mov eax, dword [ebp - 0x1044]
mov dword [ebp - 0x104c], eax
mov esi, dword [ebp - 0x104c]
push 1
lea ecx, [ebp - 0x2704]
call fcn.00431e5c
cmp esi, dword [eax]
jl 0x47a519
mov dword [ebp - 0x1054], 1
jmp 0x47a520
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1edc]
imul eax, dword [ebp - 0x1054]
mov dword [ebp - 0x25c0], eax
mov dword [ebp - 0x228], 0
jmp 0x47a550
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jg 0x47a5ae
mov eax, dword [ebp - 0x228]
cmp dword [ebp + eax*4 - 0x1edc], 0xbb35
jl 0x47a578
mov dword [ebp - 0x105c], 1
jmp 0x47a57f
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x8ac], eax
mov byte [ebp - 0x23e], 0
movzx eax, byte [ebp - 0x23e]
test eax, eax
je 0x47a5ac
push 0x10e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x47a543
jmp 0x47a2cc
lea ecx, [ebp - 0x2704]
call fcn.00431e40
jmp 0x47a261
jmp 0x47a0b0
mov dword [ebp - 0x28f4], 5
mov dword [ebp - 0x28f0], 5
mov dword [ebp - 0x28ec], 5
mov dword [ebp - 0x28e8], 5
lea ecx, [ebp - 0xa59]
call fcn.00431e6b
push eax
lea eax, [ebp - 0x28e4]
push eax
lea eax, [ebp - 0x28f4]
push eax
lea ecx, [ebp - 0x3408]
call fcn.00431e6e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2734]
call fcn.00431e1a
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x8b0], 1
mov dword [ebp - 0x1074], 0xed7c6ae4
mov dword [ebp - 0x10b4], 0
mov dword [ebp - 0x10ac], 0xfffffffd
push 1
lea ecx, [ebp - 0x2b34]
call fcn.00431d6e
mov dword [ebp - 0x170], 0
jmp 0x47a67d
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x47a69f
push dword [ebp - 0x170]
lea ecx, [ebp - 0x2b34]
call fcn.00431e5c
mov dword [eax], 0x911b9c6f
jmp 0x47a670
mov dword [ebp - 0x170], 0
jmp 0x47a6b8
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x47a6d4
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x2e9c], 0
jmp 0x47a6ab
cmp dword [ebp - 0x8b0], 0
jne 0x47a6ea
xor eax, eax
jne 0x47a6ea
and dword [ebp - 0x1064], 0
jmp 0x47a6f4
mov dword [ebp - 0x1064], 1
mov eax, dword [ebp - 0x42c]
imul eax, dword [ebp - 0x1064]
cmp eax, dword [ebp - 0x42c]
jle 0x47a715
mov dword [ebp - 0x106c], 1
jmp 0x47a71c
and dword [ebp - 0x106c], 0
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1074], eax
mov eax, dword [ebp - 0x8b0]
cmp dword [ebp - 0x1074], eax
je 0x47a742
mov dword [ebp - 0x107c], 1
jmp 0x47a749
and dword [ebp - 0x107c], 0
mov eax, 0xf6fb807c
sub eax, dword [ebp - 0x107c]
cmp eax, 0xc6b79df9
jne 0x47a767
mov dword [ebp - 0x1084], 1
jmp 0x47a76e
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x1084]
cmp eax, 0xfffffff9
jl 0x47a794
cmp dword [ebp - 0x8b0], 0
je 0x47a794
mov dword [ebp - 0x108c], 1
jmp 0x47a79b
and dword [ebp - 0x108c], 0
mov eax, dword [ebp - 0x42c]
cmp dword [ebp - 0x108c], eax
jne 0x47a7b5
mov dword [ebp - 0x1094], 1
jmp 0x47a7bc
and dword [ebp - 0x1094], 0
mov eax, dword [ebp - 0x10b4]
cmp dword [ebp - 0x1094], eax
jle 0x47a7d6
mov dword [ebp - 0x109c], 1
jmp 0x47a7dd
and dword [ebp - 0x109c], 0
cmp dword [ebp - 0x109c], 7
je 0x47a7f2
mov dword [ebp - 0x10a4], 1
jmp 0x47a7f9
and dword [ebp - 0x10a4], 0
mov eax, dword [ebp - 0x10a4]
mov dword [ebp - 0x10ac], eax
cmp dword [ebp - 0x10ac], 0xffb91e60
jae 0x47a81d
mov dword [ebp - 0x22c4], 1
jmp 0x47a824
and dword [ebp - 0x22c4], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x316c], eax
cmp dword [ebp - 0x10b4], 0x4c9d8d92
jle 0x47a848
mov dword [ebp - 0x8b8], 1
jmp 0x47a84f
and dword [ebp - 0x8b8], 0
push 0
lea ecx, [ebp - 0x2b34]
call fcn.00431e5c
mov ecx, dword [ebp - 0x8b8]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8b8]
mov dword [ebp + eax - 0x2e9c], ecx
lea ecx, [ebp - 0x2b34]
call fcn.00431e40
push 1
lea ecx, [ebp - 0x2ab0]
call fcn.00431d6e
mov dword [ebp - 0xac], 0xffff
mov dword [ebp - 0x10cc], 0xdc6b79df
mov dword [ebp - 0x5f4], 0xadf29855
mov dword [ebp - 0x10f4], 0xb2d3650d
mov dword [ebp - 0x5ec], 0
jmp 0x47a8d0
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 2
jge 0x47a8ec
mov eax, dword [ebp - 0x5ec]
mov dword [ebp + eax*4 - 0x30f8], 0x8014
jmp 0x47a8c3
cmp dword [ebp - 0xac], 0
je 0x47a90f
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jge 0x47a90f
mov dword [ebp - 0x10bc], 1
jmp 0x47a916
and dword [ebp - 0x10bc], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x10bc], eax
je 0x47aa8f
mov dword [ebp - 0x1f0], 0xf368a901
mov dword [ebp - 0x10dc], 1
mov dword [ebp - 0xac], 0
jmp 0x47a955
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x2e
jg 0x47aa8d
mov eax, 0xb545
test eax, eax
je 0x47a993
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
sub eax, 7
jne 0x47a993
or eax, 0xffffffff
jne 0x47a993
mov dword [ebp - 0x10c4], 1
jmp 0x47a99a
and dword [ebp - 0x10c4], 0
mov eax, dword [ebp - 0x10c4]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x10cc]
add eax, 0x3ca955a
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2c08], eax
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x2f24], eax
mov eax, dword [ebp - 0x5f4]
add eax, dword [ebp - 0xac]
cmp eax, 0xceffb91e
je 0x47a9f4
cmp dword [ebp - 0x1f0], 0
jne 0x47a9f4
and dword [ebp - 0x10d4], 0
jmp 0x47a9fe
mov dword [ebp - 0x10d4], 1
mov eax, dword [ebp - 0x10dc]
imul eax, dword [ebp - 0x10d4]
test eax, eax
je 0x47aa24
cmp dword [ebp - 0x10dc], 0
je 0x47aa24
mov dword [ebp - 0x10e4], 1
jmp 0x47aa2b
and dword [ebp - 0x10e4], 0
cmp dword [ebp - 0x10e4], 2
jne 0x47aa40
mov dword [ebp - 0x10ec], 1
jmp 0x47aa47
and dword [ebp - 0x10ec], 0
mov eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x10f4], eax
mov dword [ebp - 0x1f0], 0
jmp 0x47aa6c
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x47aa88
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x30f8], 0xffff
jmp 0x47aa5f
jmp 0x47a948
jmp 0x47aa9b
mov eax, dword [ebp - 0x10f4]
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x24fc], 0x8d40
mov dword [ebp - 0x2c10], 0x34215e1a
mov dword [ebp - 0x3264], 1
mov dword [ebp - 0x434], 0xfffffff8
mov eax, dword [ebp - 0x24fc]
sub eax, 0xc290
je 0x47ab28
mov dword [ebp - 0x2c18], 0x38462751
mov dword [ebp - 0x2f2c], 1
mov dword [ebp - 0x2c20], 0xc588e1b6
mov dword [ebp - 0x317c], 0xffffffff
mov dword [ebp - 0x2c28], 0x38b6
mov dword [ebp - 0x2f34], 0xffffffff
mov dword [ebp - 0x10fc], 0xffffffff
mov eax, dword [ebp - 0x10fc]
dec eax
mov dword [ebp - 0x10fc], eax
jmp 0x47abb7
push 2
lea ecx, [ebp - 0x2b4c]
call fcn.00431d6e
mov dword [ebp - 0x5fc], 0
jmp 0x47ab4e
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 2
jge 0x47ab70
push dword [ebp - 0x5fc]
lea ecx, [ebp - 0x2b4c]
call fcn.00431e5c
mov dword [eax], 0xfffffffb
jmp 0x47ab41
mov dword [ebp - 0x434], 0
jmp 0x47ab89
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 1
jg 0x47abac
push dword [ebp - 0x434]
lea ecx, [ebp - 0x2b4c]
call fcn.00431e5c
cmp dword [eax], 0
je 0x47abaa
jmp 0x47abac
jmp 0x47ab7c
lea ecx, [ebp - 0x2b4c]
call fcn.00431e40
mov dword [ebp - 0x604], 0
jmp 0x47abd0
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 1
jge 0x47abf2
push dword [ebp - 0x604]
lea ecx, [ebp - 0x2ab0]
call fcn.00431e5c
mov dword [eax], 0x43b2b74c
jmp 0x47abc3
mov dword [ebp - 0x190], 0
push 3
lea ecx, [ebp - 0xa74]
call fcn.00431d6e
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x8c0], 0x64a11600
mov dword [ebp - 0x60c], 0
jmp 0x47ac36
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 3
jge 0x47ac58
push dword [ebp - 0x60c]
lea ecx, [ebp - 0xa74]
call fcn.00431e5c
mov dword [eax], 0xdb34
jmp 0x47ac29
mov dword [ebp - 0x190], 0
jmp 0x47ac71
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffec
jge 0x47ac93
mov dword [ebp - 0x1104], 0xd925b0e4
mov eax, dword [ebp - 0x1104]
inc eax
mov dword [ebp - 0x1104], eax
jmp 0x47ac64
mov dword [ebp - 0x190], 0
jmp 0x47acac
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jg 0x47b013
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x43c], 0
jmp 0x47acdc
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 2
jg 0x47b00e
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1b4], 0xffffffff
mov dword [ebp - 0x1b4], 0
jmp 0x47ad16
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x47b009
push 4
lea ecx, [ebp - 0x1fe4]
call fcn.00431d6e
mov dword [ebp - 0x614], 0
jmp 0x47ad49
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 4
jge 0x47ad6b
push dword [ebp - 0x614]
lea ecx, [ebp - 0x1fe4]
call fcn.00431e5c
mov dword [eax], 4
jmp 0x47ad3c
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1bc], 0
jmp 0x47ad8e
cmp dword [ebp - 0x1bc], 2
jg 0x47aff9
mov dword [ebp - 0x444], 0x8d963785
mov dword [ebp - 0x25c8], 0xfffd
mov dword [ebp - 0x444], 2
jmp 0x47adc8
cmp dword [ebp - 0x444], 0
jl 0x47ae27
lea ecx, [ebp - 0x1fe4]
call fcn.00431e40
jmp 0x47ad09
jmp 0x47accf
jmp 0x47ac9f
lea ecx, [ebp - 0xa74]
call fcn.00431e40
push 1
lea ecx, [ebp - 0x2734]
call fcn.00431e5c
mov dword [eax], 0xfffffff7
jmp 0x47b057
push 1
lea ecx, [ebp - 0x2734]
call fcn.00431e5c
cmp dword [eax], 0xffffffee
jge 0x47d543
mov dword [ebp - 0x1c4], 0xb90da115
mov dword [ebp - 0x61c], 0
jmp 0x47b090
mov eax, dword [ebp - 0x61c]
inc eax
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x61c], 1
jge 0x47b0ac
mov eax, dword [ebp - 0x61c]
mov dword [ebp + eax*4 - 0x38c], 4
jmp 0x47b083
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp + eax - 0x38c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x38c]
mov dword [ebp - 0x32ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
jne 0x47b160
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
jne 0x47b10b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
jne 0x47b10b
and dword [ebp - 0x1154], 0
jmp 0x47b115
mov dword [ebp - 0x1154], 1
cmp dword [ebp - 0x1c4], 0
jge 0x47b12a
mov dword [ebp - 0x114c], 1
jmp 0x47b131
and dword [ebp - 0x114c], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x114c], eax
jne 0x47b14b
mov dword [ebp - 0x115c], 1
jmp 0x47b152
and dword [ebp - 0x115c], 0
mov eax, dword [ebp - 0x1154]
cmp eax, dword [ebp - 0x115c]
jl 0x47b1b1
mov dword [ebp - 0x1c4], 0
jmp 0x47b179
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x47b195
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x38c], 0xffffffff
jmp 0x47b16c
mov byte [ebp - 0x244], 0
movzx eax, byte [ebp - 0x244]
test eax, eax
je 0x47b1af
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x47b1c9
mov byte [ebp - 0x246], 0
movzx eax, byte [ebp - 0x246]
test eax, eax
je 0x47b1c9
mov dword [ebp - 0xac0], 0x82a1836c
mov dword [ebp - 0xabc], 0x82a1836c
mov dword [ebp - 0xab8], 0x82a1836c
mov dword [ebp - 0xab4], 0x82a1836c
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0x898], 1
mov dword [ebp - 0x44c], 0x1bb000e2
mov dword [ebp - 0xd4], 0xa1a8f1ed
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xac0]
cmp dword [ebp + eax - 0xac0], ecx
jl 0x47b329
lea ecx, [ebp - 0x2ab0]
call fcn.00431e40
lea ecx, [ebp - 0x2734]
call fcn.00431e40
mov dword [ebp - 0x6a4], 0x3dce9d05
mov dword [ebp - 0x31f0], 0xff40fc02
mov dword [ebp - 0x69c], 0
jmp 0x47d586
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 3
jge 0x47d5a2
mov eax, dword [ebp - 0x69c]
mov dword [ebp + eax*4 - 0x3138], 0x825e
jmp 0x47d579
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3138]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3138], eax
mov dword [ebp - 0x6a4], 8
jmp 0x47d5d6
mov eax, dword [ebp - 0x6a4]
dec eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0xffffffe9
jg 0x47d5fd
mov byte [ebp - 0x285], 0
movzx eax, byte [ebp - 0x285]
test eax, eax
je 0x47d5fb
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x47d5c9
call fcn.00485712
cdq
push 3
pop ecx
idiv ecx
add edx, 3
imul eax, edx, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x482c80
mov dword [ebp - 0x1484], 7
mov dword [ebp - 0x6ac], 0x6887
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x1494], 0x3191b495
mov dword [ebp - 0x2ce8], 0x11e043ee
mov dword [ebp - 0x2944], 0x8451f1e2
mov dword [ebp - 0x2940], 0x8451f1e2
mov dword [ebp - 0x293c], 0x8451f1e2
mov dword [ebp - 0x2938], 0x8451f1e2
lea ecx, [ebp - 0x891]
call fcn.00431e6b
push eax
lea eax, [ebp - 0x2934]
push eax
lea eax, [ebp - 0x2944]
push eax
lea ecx, [ebp - 0x3430]
call fcn.00431e6e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3368]
call fcn.00431e1a
mov dword [ebp - 0x14a4], 0xc31e
mov eax, dword [ebp - 0x1484]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0
je 0x47d7a9
cmp dword [ebp - 0x6ac], 0
jne 0x47d6e4
mov dword [ebp - 0x146c], 1
jmp 0x47d6eb
and dword [ebp - 0x146c], 0
cmp dword [ebp - 0x146c], 0x729cf308
jge 0x47d703
mov dword [ebp - 0x2568], 1
jmp 0x47d70a
and dword [ebp - 0x2568], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x2f94], eax
cmp dword [ebp - 0x6ac], 0x38e8
jg 0x47d72e
mov dword [ebp - 0x1474], 1
jmp 0x47d735
and dword [ebp - 0x1474], 0
cmp dword [ebp - 0x1474], 0xfffffffd
jle 0x47d74a
mov dword [ebp - 0x147c], 1
jmp 0x47d751
and dword [ebp - 0x147c], 0
cmp dword [ebp - 0x147c], 0
je 0x47d766
mov dword [ebp - 0x2344], 1
jmp 0x47d76d
and dword [ebp - 0x2344], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x2cf0], eax
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x32c8], eax
mov eax, dword [ebp - 0x1494]
mov dword [ebp - 0x2cf8], eax
cmp dword [ebp - 0x1484], 0xcb302aff
je 0x47d7a9
mov dword [ebp - 0x148c], 1
jmp 0x47d7b0
and dword [ebp - 0x148c], 0
mov eax, dword [ebp - 0x148c]
sub eax, dword [ebp - 0x1494]
cmp eax, 0xfffffffe
jge 0x47d7cd
mov dword [ebp - 0x149c], 1
jmp 0x47d7d4
and dword [ebp - 0x149c], 0
mov eax, dword [ebp - 0x149c]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x14a4]
dec eax
mov dword [ebp - 0x14a4], eax
lea ecx, [ebp - 0x3368]
call fcn.00431e40
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14b4], 0x75ee4c20
mov dword [ebp - 0x1504], 1
push 2
lea ecx, [ebp - 0x2554]
call fcn.00431d6e
mov dword [ebp - 0x2604], 0x2324
push 2
lea ecx, [ebp - 0x29b4]
call fcn.00431d6e
mov dword [ebp - 0x260c], 0x3922
mov dword [ebp - 0x394], 0xbec7a429
mov dword [ebp - 0x5c], 0
jmp 0x47d85b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x47d877
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2554]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x47d854
mov dword [ebp - 0x5c], 0
jmp 0x47d887
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x47d8a3
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x29b4]
call fcn.00431e5c
mov dword [eax], 0x734e2e0f
jmp 0x47d880
mov dword [ebp - 0x5c], 0
jmp 0x47d8b3
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x47d8c9
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x3148], 0x12afbcae
jmp 0x47d8ac
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2f9c], eax
cmp dword [ebp - 0x18], 1
jb 0x47d8e4
mov dword [ebp - 0x14ac], 1
jmp 0x47d8eb
and dword [ebp - 0x14ac], 0
mov eax, dword [ebp - 0x14ac]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
add eax, 0xe07
jne 0x47d910
cmp dword [ebp - 0x18], 0
jne 0x47d910
and dword [ebp - 0x14bc], 0
jmp 0x47d91a
mov dword [ebp - 0x14bc], 1
mov dword [ebp - 0x14b4], 0xffff
mov eax, dword [ebp - 0x14b4]
cmp eax, dword [ebp - 0x14bc]
jl 0x47d93e
mov dword [ebp - 0x14c4], 1
jmp 0x47d945
and dword [ebp - 0x14c4], 0
mov eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x1504], eax
cmp dword [ebp - 0x18], 0xb07d0d1d
jne 0x47d966
mov dword [ebp - 0x14cc], 1
jmp 0x47d96d
and dword [ebp - 0x14cc], 0
mov eax, dword [ebp - 0x14cc]
add eax, 0x38146723
cmp eax, dword [ebp - 0x18]
jg 0x47d989
mov dword [ebp - 0x14d4], 1
jmp 0x47d990
and dword [ebp - 0x14d4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14d4], eax
je 0x47d9a7
mov dword [ebp - 0x14dc], 1
jmp 0x47d9ae
and dword [ebp - 0x14dc], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14dc], eax
jne 0x47d9c5
mov dword [ebp - 0x14e4], 1
jmp 0x47d9cc
and dword [ebp - 0x14e4], 0
cmp dword [ebp - 0x14e4], 3
jbe 0x47d9e1
mov dword [ebp - 0x14ec], 1
jmp 0x47d9e8
and dword [ebp - 0x14ec], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14ec], eax
jg 0x47d9ff
mov dword [ebp - 0x14f4], 1
jmp 0x47da06
and dword [ebp - 0x14f4], 0
mov eax, dword [ebp - 0x14f4]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x14fc], eax
push 0
lea ecx, [ebp - 0x2554]
call fcn.00431e5c
mov ecx, dword [ebp - 0x14fc]
mov dword [eax], ecx
cmp dword [ebp - 0x14fc], 0
jne 0x47da45
cmp dword [ebp - 0x2604], 0
jne 0x47da45
and dword [ebp - 0x234c], 0
jmp 0x47da4f
mov dword [ebp - 0x234c], 1
mov eax, dword [ebp - 0x1504]
mov dword [ebp - 0x2d00], eax
cmp dword [ebp - 0x18], 0xffffffff
ja 0x47da6d
mov dword [ebp - 0x150c], 1
jmp 0x47da74
and dword [ebp - 0x150c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x150c], eax
jne 0x47da8b
mov dword [ebp - 0x908], 1
jmp 0x47da92
and dword [ebp - 0x908], 0
push 1
lea ecx, [ebp - 0x29b4]
call fcn.00431e5c
mov ecx, dword [ebp - 0x908]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x908], eax
je 0x47dabe
mov dword [ebp - 0x1514], 1
jmp 0x47dac5
and dword [ebp - 0x1514], 0
cmp dword [ebp - 0x1514], 0xffffffff
jbe 0x47dada
mov dword [ebp - 0x151c], 1
jmp 0x47dae1
and dword [ebp - 0x151c], 0
mov eax, dword [ebp - 0x260c]
cmp dword [ebp - 0x151c], eax
jl 0x47db0d
push 0
lea ecx, [ebp - 0x2554]
call fcn.00431e5c
cmp dword [eax], 0
je 0x47db0d
mov dword [ebp - 0x910], 1
jmp 0x47db14
and dword [ebp - 0x910], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x910]
mov dword [ebp + eax - 0x3148], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x910], eax
jle 0x47db41
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3148], 0
jne 0x47db51
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x47db51
and dword [ebp - 0x1524], 0
jmp 0x47db5b
mov dword [ebp - 0x1524], 1
mov eax, dword [ebp - 0x1524]
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x394], 0
jmp 0x47db80
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 2
jge 0x47dba2
push dword [ebp - 0x394]
lea ecx, [ebp - 0x2554]
call fcn.00431e5c
mov dword [eax], 0xfffffff6
jmp 0x47db73
lea ecx, [ebp - 0x29b4]
call fcn.00431e40
lea ecx, [ebp - 0x2554]
call fcn.00431e40
push 2
lea ecx, [ebp - 0x3158]
call fcn.00431d6e
mov dword [ebp - 0x6c4], 7
mov dword [ebp - 0x31dc], 0
mov dword [ebp - 0x6bc], 0
jmp 0x47dbf2
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 2
jge 0x47dc11
push dword [ebp - 0x6bc]
lea ecx, [ebp - 0x3158]
call fcn.00431e5c
and dword [eax], 0
jmp 0x47dbe5
mov dword [ebp - 0x6c4], 0
jmp 0x47dc2a
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 1
jg 0x47dc51
mov byte [ebp - 0x287], 0
movzx eax, byte [ebp - 0x287]
test eax, eax
je 0x47dc4f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x47dc1d
lea ecx, [ebp - 0x3158]
call fcn.00431e40
mov dword [ebp - 0x1854], 0x4643cdf9
mov dword [ebp - 0x918], 0xea6801fc
mov dword [ebp - 0x920], 0xec17e5c2
push 1
lea ecx, [ebp - 0x2b28]
call fcn.00431d6e
mov dword [ebp - 0x2574], 0xfffffff6
push 1
lea ecx, [ebp - 0x3168]
call fcn.00431d6e
mov dword [ebp - 0xec], 0
jmp 0x47dcb7
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x47dcd9
push dword [ebp - 0xec]
lea ecx, [ebp - 0x2b28]
call fcn.00431e5c
mov dword [eax], 0x79c63c40
jmp 0x47dcaa
mov dword [ebp - 0xec], 0
jmp 0x47dcf2
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x47dd14
push dword [ebp - 0xec]
lea ecx, [ebp - 0x3168]
call fcn.00431e5c
mov dword [eax], 0xffd8
jmp 0x47dce5
cmp dword [ebp - 0x918], 0xbbef
je 0x47dd2c
mov dword [ebp - 0x2354], 1
jmp 0x47dd33
and dword [ebp - 0x2354], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x2d08], eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x152c], eax
push 0
lea ecx, [ebp - 0x2b28]
call fcn.00431e5c
mov ecx, dword [ebp - 0x152c]
mov dword [eax], ecx
cmp dword [ebp - 0x152c], 0
jne 0x47dd7e
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x2fa4], eax
mov eax, 0x5689
test eax, eax
je 0x47dd8f
xor eax, eax
inc eax
je 0x47dd8f
mov dword [ebp - 0x1534], 1
jmp 0x47dd96
and dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x920]
cmp dword [ebp - 0x1534], eax
je 0x47ddb0
mov dword [ebp - 0x153c], 1
jmp 0x47ddb7
and dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0x153c]
add eax, 0xc70a
cmp eax, dword [ebp - 0x920]
jl 0x47ddd6
mov dword [ebp - 0x1544], 1
jmp 0x47dddd
and dword [ebp - 0x1544], 0
cmp dword [ebp - 0x1544], 0x3ee76373
jle 0x47ddf5
mov dword [ebp - 0x154c], 1
jmp 0x47ddfc
and dword [ebp - 0x154c], 0
mov eax, dword [ebp - 0x154c]
mov dword [ebp - 0x2574], eax
lea ecx, [ebp - 0x3168]
call fcn.00431e40
lea ecx, [ebp - 0x2b28]
call fcn.00431e40
mov dword [ebp - 0x20a4], 9
push 2
lea ecx, [ebp - 0x854]
call fcn.00431d6e
mov dword [ebp - 0x9c], 0xaa6e6f7
mov dword [ebp - 0x98], 0xfff7
mov dword [ebp - 0x15cc], 0x31d4
mov dword [ebp - 0xf4], 0
jmp 0x47de6c
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x47de8e
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov dword [eax], 0xfffffff6
jmp 0x47de5f
mov dword [ebp - 0xf4], 0
jmp 0x47dea7
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x47dec3
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x29cc], 3
jmp 0x47de9a
mov byte [ebp - 0x289], 0
movzx eax, byte [ebp - 0x289]
test eax, eax
je 0x47deed
push 0
push 0x386
push 0
push 0
push 0x16d0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
push 1
lea ecx, [ebp - 0x854]
call fcn.00431e5c
push 1
lea ecx, [ebp - 0x854]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x47df32
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x29cc], 0
jne 0x47df32
and dword [ebp - 0x1554], 0
jmp 0x47df3c
mov dword [ebp - 0x1554], 1
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov esi, eax
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov ecx, dword [ebp - 0x1554]
imul ecx, dword [eax]
cmp dword [esi], ecx
jle 0x47df71
mov dword [ebp - 0x155c], 1
jmp 0x47df78
and dword [ebp - 0x155c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x155c]
sub ecx, dword [ebp + eax - 0x29cc]
cmp ecx, dword [ebp - 0x98]
jne 0x47df9f
mov dword [ebp - 0x1564], 1
jmp 0x47dfa6
and dword [ebp - 0x1564], 0
mov dword [ebp - 0x9c], 0xc553
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x1564]
cmp eax, 0xf0a9b27f
je 0x47dfcf
mov dword [ebp - 0x156c], 1
jmp 0x47dfd6
and dword [ebp - 0x156c], 0
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov ecx, dword [ebp - 0x156c]
cmp ecx, dword [eax]
jne 0x47dff9
mov dword [ebp - 0x1574], 1
jmp 0x47e000
and dword [ebp - 0x1574], 0
cmp dword [ebp - 0x1574], 0xffffffff
jge 0x47e308
mov dword [ebp - 0x39c], 1
mov dword [ebp - 0x928], 0
mov dword [ebp - 0x98], 0
jmp 0x47e03a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x26
jne 0x47e0f2
mov dword [ebp - 0x9c], 0xfffffff2
jmp 0x47e060
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
je 0x47e0ed
mov dword [ebp - 0x6cc], 0xfffffff8
mov dword [ebp - 0x6cc], 0
jmp 0x47e090
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 2
jg 0x47e0e8
mov dword [ebp - 0x6d4], 0xffffffff
mov dword [ebp - 0x6d4], 0
jmp 0x47e0bc
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x6d4], 2
jg 0x47e0e6
mov byte [ebp - 0x28b], 0
movzx eax, byte [ebp - 0x28b]
test eax, eax
je 0x47e0e4
push 0x1119
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47e0af
jmp 0x47e083
jmp 0x47e053
jmp 0x47e02d
cmp dword [ebp - 0x39c], 0
je 0x47e2e3
cmp dword [ebp - 0x39c], 0
jne 0x47e149
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x47e149
mov esi, dword [ebp - 0x98]
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
sub esi, dword [eax]
cmp esi, dword [ebp - 0x39c]
jl 0x47e140
cmp dword [ebp - 0x98], 0
jne 0x47e149
and dword [ebp - 0x157c], 0
jmp 0x47e153
mov dword [ebp - 0x157c], 1
cmp dword [ebp - 0x157c], 0xf2ba10f4
ja 0x47e16b
mov dword [ebp - 0x1584], 1
jmp 0x47e172
and dword [ebp - 0x1584], 0
mov eax, dword [ebp - 0x1584]
sub eax, dword [ebp - 0x15cc]
jne 0x47e190
push 8
pop eax
test eax, eax
jne 0x47e190
and dword [ebp - 0x158c], 0
jmp 0x47e19a
mov dword [ebp - 0x158c], 1
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov ecx, dword [ebp - 0x158c]
cmp ecx, dword [eax]
jl 0x47e1bd
mov dword [ebp - 0x1594], 1
jmp 0x47e1c4
and dword [ebp - 0x1594], 0
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x1594], eax
jl 0x47e1de
mov dword [ebp - 0x159c], 1
jmp 0x47e1e5
and dword [ebp - 0x159c], 0
mov eax, dword [ebp - 0x159c]
sub eax, dword [ebp - 0x928]
cmp eax, 0xfffffff9
jl 0x47e208
mov eax, 0x725d
test eax, eax
jne 0x47e208
and dword [ebp - 0x15a4], 0
jmp 0x47e212
mov dword [ebp - 0x15a4], 1
push 1
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov ecx, dword [ebp - 0x15a4]
cmp ecx, dword [eax]
jne 0x47e235
mov dword [ebp - 0x15ac], 1
jmp 0x47e23c
and dword [ebp - 0x15ac], 0
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x15ac], eax
jg 0x47e265
push 0
lea ecx, [ebp - 0x854]
call fcn.00431e5c
cmp dword [eax], 0
jne 0x47e265
and dword [ebp - 0x15b4], 0
jmp 0x47e26f
mov dword [ebp - 0x15b4], 1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x29cc], 0xca8c
mov eax, dword [ebp - 0x15b4]
add eax, 0xca8c
cmp eax, dword [ebp - 0x928]
jge 0x47e29e
mov dword [ebp - 0x15bc], 1
jmp 0x47e2a5
and dword [ebp - 0x15bc], 0
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x15bc], eax
jg 0x47e2bf
mov dword [ebp - 0x15c4], 1
jmp 0x47e2c6
and dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x928]
imul eax, dword [ebp - 0x15c4]
test eax, eax
je 0x47e2e3
mov dword [ebp - 0x235c], 1
jmp 0x47e2ea
and dword [ebp - 0x235c], 0
push 1
lea ecx, [ebp - 0x854]
call fcn.00431e5c
mov eax, dword [ebp - 0x15cc]
mov dword [ebp - 0x9c], eax
jmp 0x47e39d
mov dword [ebp - 0x98], 0
jmp 0x47e321
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 8
jle 0x47e39d
mov dword [ebp - 0x2638], 0xffffffff
mov dword [ebp - 0x9c], 0
jmp 0x47e34d
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jg 0x47e38a
mov byte [ebp - 0x28d], 0
movzx eax, byte [ebp - 0x28d]
test eax, eax
je 0x47e388
push 0
push 0x54d
push 0x191d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
jmp 0x47e340
cmp dword [ebp - 0x2638], 0
je 0x47e398
jmp 0x47e314
jmp 0x47e314
lea ecx, [ebp - 0x854]
call fcn.00431e40
push 3
lea ecx, [ebp - 0x3198]
call fcn.00431d6e
mov dword [ebp - 0x47c], 0x61f9c28a
mov dword [ebp - 0x484], 0x29be1d92
mov dword [ebp - 0x2364], 0xf5872d9
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x47c], 0xe
jmp 0x47e3f8
mov eax, dword [ebp - 0x47c]
dec eax
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x47c], 4
jl 0x47e431
mov dword [ebp - 0x484], 0xfffffff5
jmp 0x47e41a
mov eax, dword [ebp - 0x484]
dec eax
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0xffffffe8
jge 0x47e42f
mov dword [ebp - 0x2364], 0x7e4fc22
jmp 0x47e40d
jmp 0x47e3eb
push 1
lea ecx, [ebp - 0x3188]
call fcn.00431d6e
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x344], 0x791b1675
mov dword [ebp - 0xfc], 0
jmp 0x47e468
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x47e484
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x1f4], 6
jmp 0x47e45b
mov dword [ebp - 0xfc], 0
jmp 0x47e49d
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 4
jge 0x47e4b9
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x3398], 1
jmp 0x47e490
cmp dword [ebp - 4], 0
je 0x47e610
mov dword [ebp - 0x6dc], 0x4ea6801f
mov dword [ebp - 0x48c], 0
cmp dword [ebp - 0x6dc], 1
jle 0x47e4ed
xor eax, eax
jne 0x47e4ed
and dword [ebp - 0x15d4], 0
jmp 0x47e4f7
mov dword [ebp - 0x15d4], 1
cmp dword [ebp - 0x15d4], 0x9933
jge 0x47e50f
mov dword [ebp - 0x15dc], 1
jmp 0x47e516
and dword [ebp - 0x15dc], 0
mov eax, dword [ebp - 0x6dc]
cmp dword [ebp - 0x15dc], eax
jle 0x47e533
cmp dword [ebp - 4], 0
jne 0x47e533
and dword [ebp - 0x15e4], 0
jmp 0x47e53d
mov dword [ebp - 0x15e4], 1
mov eax, dword [ebp - 0x48c]
add eax, dword [ebp - 0x15e4]
cmp dword [ebp - 0x48c], eax
jne 0x47e563
cmp dword [ebp - 4], 0
je 0x47e563
mov dword [ebp - 0x15ec], 1
jmp 0x47e56a
and dword [ebp - 0x15ec], 0
cmp dword [ebp - 0x15ec], 0x81d2
jl 0x47e582
mov dword [ebp - 0x15f4], 1
jmp 0x47e589
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x15f4], eax
je 0x47e5a3
mov dword [ebp - 0x2038], 1
jmp 0x47e5aa
and dword [ebp - 0x2038], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x2d10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3274], eax
cmp dword [ebp - 0x6dc], 0x98963ec5
jae 0x47e5d7
mov dword [ebp - 0x15fc], 1
jmp 0x47e5de
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x15fc], eax
jle 0x47e5f8
mov dword [ebp - 0x1604], 1
jmp 0x47e5ff
and dword [ebp - 0x1604], 0
mov eax, dword [ebp - 0x1604]
mov dword [ebp - 0x48c], eax
jmp 0x47eb53
mov dword [ebp - 0x1ec], 0xb0
mov dword [ebp - 4], 0xffffffe4
jmp 0x47e62a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff0
jge 0x47e8d4
mov dword [ebp - 0x498], 0x9f3c
mov dword [ebp - 0x33c], 0
mov dword [ebp - 0x204c], 0x52307d3e
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x2d18], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x2fac], eax
mov eax, dword [ebp - 0x1ec]
dec eax
dec eax
cmp eax, dword [ebp - 4]
jl 0x47e683
mov dword [ebp - 0x203c], 1
jmp 0x47e68a
and dword [ebp - 0x203c], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x2d20], eax
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 4], eax
jl 0x47e6ad
mov dword [ebp - 0x160c], 1
jmp 0x47e6b4
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 4]
imul eax, dword [ebp - 0x160c]
add eax, 0x47d0
jne 0x47e6d7
mov eax, 0x9242
test eax, eax
jne 0x47e6d7
and dword [ebp - 0x1614], 0
jmp 0x47e6e1
mov dword [ebp - 0x1614], 1
mov eax, dword [ebp - 0x1614]
sub eax, dword [ebp - 0x498]
cmp eax, 0xdc1b
jle 0x47e709
cmp dword [ebp - 0x33c], 0
je 0x47e709
mov dword [ebp - 0x161c], 1
jmp 0x47e710
and dword [ebp - 0x161c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x161c], eax
jle 0x47e727
mov dword [ebp - 0x1624], 1
jmp 0x47e72e
and dword [ebp - 0x1624], 0
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x1624], eax
jne 0x47e748
mov dword [ebp - 0x162c], 1
jmp 0x47e74f
and dword [ebp - 0x162c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x162c]
mov dword [ebp + eax - 0x1f4], ecx
cmp dword [ebp - 0x33c], 0
jne 0x47e772
cmp dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x31e4], eax
cmp dword [ebp - 0x344], 0xe3c1dc0a
je 0x47e796
mov dword [ebp - 0x1634], 1
jmp 0x47e79d
and dword [ebp - 0x1634], 0
cmp dword [ebp - 0x1634], 0xffffffff
jl 0x47e7b2
mov dword [ebp - 0x163c], 1
jmp 0x47e7b9
and dword [ebp - 0x163c], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x163c], eax
jl 0x47e7d3
mov dword [ebp - 0x1644], 1
jmp 0x47e7da
and dword [ebp - 0x1644], 0
cmp dword [ebp - 0x1644], 0xfffffffa
jae 0x47e7f5
cmp dword [ebp - 0x1ec], 0
jne 0x47e7f5
and dword [ebp - 0x164c], 0
jmp 0x47e7ff
mov dword [ebp - 0x164c], 1
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x164c], eax
jge 0x47e814
cmp dword [ebp - 0x498], 0
cmp dword [ebp - 0x33c], 0
jne 0x47e82f
cmp dword [ebp - 0x33c], 0
jne 0x47e82f
and dword [ebp - 0x2044], 0
jmp 0x47e839
mov dword [ebp - 0x2044], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2d28], eax
cmp dword [ebp - 0x33c], 0xe5c5cc99
jae 0x47e85a
mov dword [ebp - 0x1654], 1
jmp 0x47e861
and dword [ebp - 0x1654], 0
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x1654], eax
jne 0x47e87b
mov dword [ebp - 0x165c], 1
jmp 0x47e882
and dword [ebp - 0x165c], 0
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x165c]
je 0x47e89c
mov dword [ebp - 0x1664], 1
jmp 0x47e8a3
and dword [ebp - 0x1664], 0
mov eax, dword [ebp - 0x1664]
mov dword [ebp - 0x204c], eax
mov byte [ebp - 0x28f], 0
movzx eax, byte [ebp - 0x28f]
test eax, eax
je 0x47e8cf
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x47e623
mov dword [ebp - 0x344], 0
jmp 0x47e8ed
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x30
je 0x47eb53
mov dword [ebp - 0x1684], 0xffffffff
mov dword [ebp - 0x6e4], 0
jmp 0x47e91d
mov eax, dword [ebp - 0x6e4]
inc eax
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 2
jge 0x47e939
mov eax, dword [ebp - 0x6e4]
mov dword [ebp + eax*4 - 0x2ea8], 0x35242359
jmp 0x47e910
mov dword [ebp - 4], 0
jmp 0x47e949
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x47eb4e
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1f4]
mov dword [ebp - 0x2fb4], eax
mov eax, 0x27f1
sub eax, dword [ebp - 0x1ec]
cmp eax, 0x888327bc
je 0x47e9ac
mov byte [ebp - 0x291], 0
movzx eax, byte [ebp - 0x291]
test eax, eax
je 0x47e9a7
push 0
push 0x1fe8
push 0
push 0x2240
push 0x1e67
push 0
push 0xc18
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x47eb49
mov dword [ebp - 0x6ec], 0x9d8d
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1f4], 0x1fb0335
je 0x47e9cf
cmp dword [ebp - 0x1684], 0
jne 0x47e9e1
mov eax, 0xffff
test eax, eax
jne 0x47e9e1
and dword [ebp - 0x1674], 0
jmp 0x47e9eb
mov dword [ebp - 0x1674], 1
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x166c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x166c]
mov dword [ebp + eax - 0x2ea8], ecx
mov eax, dword [ebp - 0x166c]
cmp eax, dword [ebp - 0x1674]
jle 0x47ea24
mov dword [ebp - 0x167c], 1
jmp 0x47ea2b
and dword [ebp - 0x167c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x167c], eax
jne 0x47ea4f
cmp dword [ebp - 0x6ec], 0
jne 0x47ea4f
and dword [ebp - 0x2054], 0
jmp 0x47ea59
mov dword [ebp - 0x2054], 1
mov eax, dword [ebp - 0x1684]
mov dword [ebp - 0x2d30], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6ec]
cmp dword [ebp + eax - 0x1f4], ecx
jl 0x47ea96
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f4], 0
je 0x47ea96
mov dword [ebp - 0x168c], 1
jmp 0x47ea9d
and dword [ebp - 0x168c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp eax, dword [ebp - 0x168c]
je 0x47eabb
mov dword [ebp - 0x1694], 1
jmp 0x47eac2
and dword [ebp - 0x1694], 0
mov eax, dword [ebp - 0x6ec]
cmp dword [ebp - 0x1694], eax
je 0x47eadc
mov dword [ebp - 0x169c], 1
jmp 0x47eae3
and dword [ebp - 0x169c], 0
mov eax, dword [ebp - 0x169c]
sub eax, 0x9861
je 0x47eb05
cmp dword [ebp - 0x6ec], 0
je 0x47eb05
mov dword [ebp - 0x16a4], 1
jmp 0x47eb0c
and dword [ebp - 0x16a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3398]
cmp dword [ebp - 0x16a4], eax
jl 0x47eb2d
mov dword [ebp - 0x16ac], 1
jmp 0x47eb34
and dword [ebp - 0x16ac], 0
mov eax, dword [ebp - 0x16ac]
sub eax, 0x880f
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1f4], eax
jmp 0x47e942
jmp 0x47e8e0
mov dword [ebp - 0xe0], 0xca4f833f
mov dword [ebp - 0x4a0], 0x302a
push 2
lea ecx, [ebp - 0x2ac8]
call fcn.00431d6e
mov dword [ebp - 0x104], 0
jmp 0x47eb8d
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x47eba9
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0xb30], 8
jmp 0x47eb80
mov dword [ebp - 0x104], 0
jmp 0x47ebc2
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x47ebe4
push dword [ebp - 0x104]
lea ecx, [ebp - 0x2ac8]
call fcn.00431e5c
mov dword [eax], 1
jmp 0x47ebb5
mov dword [ebp - 0xe0], 0
jmp 0x47ebfd
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jg 0x47ec22
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0xb30]
mov dword [ebp + ecx*4 - 0xb30], eax
jmp 0x47ebf0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb30]
mov dword [ebp - 0x330c], eax
cmp dword [ebp - 0xe0], 0
jne 0x47ed27
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb30]
cmp dword [ebp - 0xe0], eax
jg 0x47ec6f
mov dword [ebp - 0x16b4], 1
jmp 0x47ec76
and dword [ebp - 0x16b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb30]
cmp dword [ebp - 0x16b4], eax
jle 0x47ec9f
cmp dword [ebp - 0x4a0], 0
je 0x47ec9f
mov dword [ebp - 0x16bc], 1
jmp 0x47eca6
and dword [ebp - 0x16bc], 0
mov eax, dword [ebp - 0x4a0]
add eax, dword [ebp - 0x16bc]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xb30]
jle 0x47eccd
mov dword [ebp - 0x16c4], 1
jmp 0x47ecd4
and dword [ebp - 0x16c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb30]
cmp dword [ebp - 0x16c4], eax
jg 0x47ecf5
mov dword [ebp - 0x930], 1
jmp 0x47ecfc
and dword [ebp - 0x930], 0
push 0
lea ecx, [ebp - 0x2ac8]
call fcn.00431e5c
mov ecx, dword [ebp - 0x930]
mov dword [eax], ecx
mov eax, dword [ebp - 0x930]
add eax, 0x1082d998
jne 0x47ed27
and dword [ebp - 0x16cc], 0
jmp 0x47ed31
mov dword [ebp - 0x16cc], 1
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x16cc], eax
jne 0x47ed54
cmp dword [ebp - 0x4a0], 0
je 0x47ed54
mov dword [ebp - 0x16d4], 1
jmp 0x47ed5b
and dword [ebp - 0x16d4], 0
cmp dword [ebp - 0x16d4], 0xc8cac31e
jae 0x47ed73
mov dword [ebp - 0x16dc], 1
jmp 0x47ed7a
and dword [ebp - 0x16dc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb30]
cmp eax, dword [ebp - 0x16dc]
jg 0x47ed9a
mov dword [ebp - 0x16e4], 1
jmp 0x47eda1
and dword [ebp - 0x16e4], 0
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x16e4], eax
jne 0x47edbb
mov dword [ebp - 0x16ec], 1
jmp 0x47edc2
and dword [ebp - 0x16ec], 0
cmp dword [ebp - 0x16ec], 1
jle 0x47edd7
mov dword [ebp - 0x16f4], 1
jmp 0x47edde
and dword [ebp - 0x16f4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x16f4]
mov dword [ebp + eax - 0xb30], ecx
lea ecx, [ebp - 0x2ac8]
call fcn.00431e40
mov dword [ebp - 0x2d38], 0x9cc2
mov dword [ebp - 0x10c], 0
jmp 0x47ee1e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x47ee3a
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x4b0], 0xc75b57fd
jmp 0x47ee11
mov dword [ebp - 0x10c], 0
jmp 0x47ee53
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x47ee6f
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x32b4], 0x2bd7
jmp 0x47ee46
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4b0], 0
jmp 0x47ee9d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4b0], 0xb
je 0x47ef00
mov dword [ebp - 0x4a8], 0x7c8a6b95
mov dword [ebp - 0x4a8], 0
jmp 0x47eed0
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 2
jge 0x47eeec
mov eax, dword [ebp - 0x4a8]
mov dword [ebp + eax*4 - 0x32b4], 0xffffffff
jmp 0x47eec3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4b0], 0
je 0x47eefe
jmp 0x47ee82
jmp 0x47ee82
mov dword [ebp - 0x6c], 0
jmp 0x47ef10
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x47ef29
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x3198]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x47ef09
mov dword [ebp - 0x114], 0xffff
mov dword [ebp - 0x4c0], 0xfffffff8
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x3a4], 0xd4fce886
mov dword [ebp - 0x64], 0
jmp 0x47ef61
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x47ef77
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x938], 0xf446cd5f
jmp 0x47ef5a
mov dword [ebp - 0x64], 0
jmp 0x47ef87
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x47ef9d
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2eb4], 0x27557bc7
jmp 0x47ef80
mov dword [ebp - 0x64], 0
jmp 0x47efad
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x47efc3
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x3178], 0xfffffffd
jmp 0x47efa6
cmp dword [ebp - 0x114], 0x18ff29ca
je 0x47efdb
mov dword [ebp - 0x205c], 1
jmp 0x47efe2
and dword [ebp - 0x205c], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x2fbc], eax
cmp dword [ebp - 0x114], 0
ja 0x47f003
mov dword [ebp - 0x16fc], 1
jmp 0x47f00a
and dword [ebp - 0x16fc], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x16fc]
cmp eax, 0xfffffff8
jbe 0x47f02d
mov eax, 0x15fb57a6
test eax, eax
jne 0x47f02d
and dword [ebp - 0x1704], 0
jmp 0x47f037
mov dword [ebp - 0x1704], 1
mov eax, dword [ebp - 0x114]
sub eax, 0x4d8a
sub eax, dword [ebp - 0x1704]
cmp dword [ebp - 0x114], eax
jg 0x47f05c
mov dword [ebp - 0x170c], 1
jmp 0x47f063
and dword [ebp - 0x170c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x170c], eax
jg 0x47f07d
mov dword [ebp - 0x1714], 1
jmp 0x47f084
and dword [ebp - 0x1714], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x1714], eax
jle 0x47f0ab
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x938], 0
jne 0x47f0ab
and dword [ebp - 0x171c], 0
jmp 0x47f0b5
mov dword [ebp - 0x171c], 1
cmp dword [ebp - 0x171c], 0xfffffff8
jbe 0x47f0ca
mov dword [ebp - 0x1724], 1
jmp 0x47f0d1
and dword [ebp - 0x1724], 0
mov eax, dword [ebp - 0x1724]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x172c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x172c]
mov dword [ebp + eax - 0x2eb4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3178]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x3178]
cmp dword [ebp - 0x172c], eax
je 0x47f136
mov dword [ebp - 0x1734], 1
jmp 0x47f13d
and dword [ebp - 0x1734], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x1734], eax
je 0x47f157
mov dword [ebp - 0x173c], 1
jmp 0x47f15e
and dword [ebp - 0x173c], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x173c], eax
jne 0x47f178
mov dword [ebp - 0x1744], 1
jmp 0x47f17f
and dword [ebp - 0x1744], 0
mov eax, dword [ebp - 0x1744]
sub eax, dword [ebp - 0x1fc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x938]
jle 0x47f1a6
mov dword [ebp - 0x174c], 1
jmp 0x47f1ad
and dword [ebp - 0x174c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x938]
cmp dword [ebp - 0x174c], eax
jle 0x47f1ce
mov dword [ebp - 0x1754], 1
jmp 0x47f1d5
and dword [ebp - 0x1754], 0
cmp dword [ebp - 0x1754], 0xfffffffe
jle 0x47f1ea
mov dword [ebp - 0x175c], 1
jmp 0x47f1f1
and dword [ebp - 0x175c], 0
cmp dword [ebp - 0x175c], 0x9efec1a2
jae 0x47f209
mov dword [ebp - 0x1764], 1
jmp 0x47f210
and dword [ebp - 0x1764], 0
cmp dword [ebp - 0x1764], 0x4fcd
jge 0x47f228
mov dword [ebp - 0x176c], 1
jmp 0x47f22f
and dword [ebp - 0x176c], 0
mov eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x176c], eax
jle 0x47f249
mov dword [ebp - 0x1774], 1
jmp 0x47f250
and dword [ebp - 0x1774], 0
mov eax, dword [ebp - 0x1774]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x47f360
mov dword [ebp - 0x3a4], 0
jmp 0x47f282
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 2
jg 0x47f333
push 2
lea ecx, [ebp - 0x29e4]
call fcn.00431d6e
mov dword [ebp - 0x530], 0
jmp 0x47f2b5
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 2
jge 0x47f2d7
push dword [ebp - 0x530]
lea ecx, [ebp - 0x29e4]
call fcn.00431e5c
mov dword [eax], 0xfff8
jmp 0x47f2a8
mov byte [ebp - 0x293], 0
movzx eax, byte [ebp - 0x293]
test eax, eax
je 0x47f2ff
push 0
push 0
push 0x906
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
lea ecx, [ebp - 0x29e4]
call fcn.00431e5c
mov dword [ebp - 0x177c], eax
mov eax, dword [ebp - 0x177c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x177c]
mov dword [ecx], eax
lea ecx, [ebp - 0x29e4]
call fcn.00431e40
jmp 0x47f275
mov byte [ebp - 0x295], 0
movzx eax, byte [ebp - 0x295]
test eax, eax
je 0x47f35b
push 0
push 0
push 0x213c
push 0x231d
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x47f461
mov dword [ebp - 0x2064], 1
mov dword [ebp - 0x4b8], 1
cmp dword [ebp - 0x2064], 0xfffffffc
jg 0x47f389
mov dword [ebp - 0x1784], 1
jmp 0x47f390
and dword [ebp - 0x1784], 0
mov eax, dword [ebp - 0x1784]
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b8], 5
jmp 0x47f3b5
mov eax, dword [ebp - 0x4b8]
dec eax
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xfffffffb
jle 0x47f461
mov dword [ebp - 0x206c], 0x9520
cmp dword [ebp - 0x4c0], 0x40b36fe0
jg 0x47f3e4
mov dword [ebp - 0x178c], 1
jmp 0x47f3eb
and dword [ebp - 0x178c], 0
mov eax, dword [ebp - 0x178c]
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1fc], 0
jmp 0x47f410
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xffffffe3
jle 0x47f45c
mov dword [ebp - 0x2074], 0
mov dword [ebp - 0x207c], 0xfffffffe
mov eax, dword [ebp - 0x206c]
cmp dword [ebp - 0x2074], eax
jne 0x47f447
mov dword [ebp - 0x1794], 1
jmp 0x47f44e
and dword [ebp - 0x1794], 0
mov eax, dword [ebp - 0x1794]
mov dword [ebp - 0x207c], eax
jmp 0x47f403
jmp 0x47f3a8
mov dword [ebp - 0x6c], 0
jmp 0x47f471
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x47f48d
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x3188]
call fcn.00431e5c
mov dword [eax], 0x51da622a
jmp 0x47f46a
mov dword [ebp - 0x34c], 0xeca4f833
mov dword [ebp - 0x534], 0
jmp 0x47f4b0
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 3
jge 0x47f4cc
mov eax, dword [ebp - 0x534]
mov dword [ebp + eax*4 - 0x2b88], 4
jmp 0x47f4a3
mov dword [ebp - 0x34c], 2
mov dword [ebp - 0x34c], 0
jmp 0x47f4ef
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jg 0x47f7f0
mov dword [ebp - 0x4c8], 0xffffffff
mov dword [ebp - 0x17ec], 3
mov dword [ebp - 0x4c8], 2
jmp 0x47f529
mov eax, dword [ebp - 0x4c8]
dec eax
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0
jl 0x47f7e0
mov dword [ebp - 0x3ac], 6
cmp dword [ebp - 0x34c], 0
je 0x47f7c3
mov dword [ebp - 0x6fc], 0xfffffffb
push 2
lea ecx, [ebp - 0x1f6c]
call fcn.00431d6e
mov dword [ebp - 0x179c], 0xffffffff
mov dword [ebp - 0x6f4], 0
jmp 0x47f587
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f4], 2
jge 0x47f5a6
push dword [ebp - 0x6f4]
lea ecx, [ebp - 0x1f6c]
call fcn.00431e5c
and dword [eax], 0
jmp 0x47f57a
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3ac]
cmp dword [ebp + eax - 0x2b88], ecx
jg 0x47f5c6
mov dword [ebp - 0x2084], 1
jmp 0x47f5cd
and dword [ebp - 0x2084], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2b88]
mov dword [ebp - 0x2d40], eax
push 1
lea ecx, [ebp - 0x1f6c]
call fcn.00431e5c
push 1
lea ecx, [ebp - 0x1f6c]
call fcn.00431e5c
mov dword [ebp - 0x179c], 5
cmp dword [ebp - 0x179c], 0xcf22a1ef
jb 0x47f61b
mov dword [ebp - 0x17a4], 1
jmp 0x47f622
and dword [ebp - 0x17a4], 0
mov eax, dword [ebp - 0x6fc]
cmp eax, dword [ebp - 0x17a4]
jl 0x47f637
cmp dword [ebp - 0x34c], 0
imul eax, dword [ebp - 0x3ac], 0x1692
cmp eax, dword [ebp - 0x3ac]
jg 0x47f655
mov dword [ebp - 0x17ac], 1
jmp 0x47f65c
and dword [ebp - 0x17ac], 0
cmp dword [ebp - 0x17ac], 7
jl 0x47f671
mov byte [ebp - 0x297], 0
movzx eax, byte [ebp - 0x297]
test eax, eax
je 0x47f7db
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x47f51c
cmp dword [ebp - 0x17ec], 0
je 0x47f7eb
jmp 0x47f7f0
jmp 0x47f4e2
mov dword [ebp - 0x6c], 0
jmp 0x47f800
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x47f816
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x940], 0
jmp 0x47f7f9
mov dword [ebp - 0xb0], 0x32b1cecb
mov dword [ebp - 0x704], 0
jmp 0x47f839
mov eax, dword [ebp - 0x704]
inc eax
mov dword [ebp - 0x704], eax
cmp dword [ebp - 0x704], 4
jge 0x47f855
mov eax, dword [ebp - 0x704]
mov dword [ebp + eax*4 - 0x1ecc], 0
jmp 0x47f82c
mov dword [ebp - 0xb0], 3
jmp 0x47f86e
cmp dword [ebp - 0xb0], 0
jl 0x47f95c
mov dword [ebp - 0x4d0], 0x7fd1e814
mov dword [ebp - 0x4d0], 3
jmp 0x47f89e
cmp dword [ebp - 0x4d0], 0
jl 0x47f92e
mov dword [ebp - 0x70c], 1
mov eax, dword [ebp - 0x4d0]
mov dword [ebp + eax*4 - 0x1ecc], 0x52eaa29c
mov dword [ebp - 0x70c], 3
jmp 0x47f8df
cmp dword [ebp - 0x70c], 0
jl 0x47f929
mov byte [ebp - 0x299], 0
movzx eax, byte [ebp - 0x299]
test eax, eax
je 0x47f957
push 0xcbf
push 0
push 0x647
push 0x18be
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x47f861
cmp dword [ebp - 0xb0], 0
je 0x47f9da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ecc], 1
jne 0x47f981
mov dword [ebp - 0x17f4], 1
jmp 0x47f988
and dword [ebp - 0x17f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ecc]
cmp dword [ebp - 0x17f4], eax
jne 0x47f9a9
mov dword [ebp - 0x17fc], 1
jmp 0x47f9b0
and dword [ebp - 0x17fc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1ecc]
add eax, dword [ebp - 0x17fc]
imul eax, eax, 0xffffffff
cmp eax, dword [ebp - 0xb0]
jg 0x47f9da
and dword [ebp - 0x1804], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ecc]
cmp dword [ebp - 0x1804], eax
jge 0x47fa01
mov dword [ebp - 0x180c], 1
jmp 0x47fa08
and dword [ebp - 0x180c], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x180c], eax
jne 0x47fa22
mov dword [ebp - 0x1814], 1
jmp 0x47fa29
and dword [ebp - 0x1814], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1814], eax
jg 0x47fa43
push 2
lea ecx, [ebp - 0x1f90]
call fcn.00431d6e
push 2
lea ecx, [ebp - 0x26c8]
call fcn.00431d6e
mov dword [ebp - 0x3dc], 0xa42
mov dword [ebp - 0x12c], 0
jmp 0x482cbd
cmp dword [ebp - 0x12c], 2
jge 0x482cdc
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x1f90]
call fcn.00431e5c
or dword [eax], 0xffffffff
jmp 0x482cb0
mov dword [ebp - 0x12c], 0
jmp 0x482cf5