Function at 0x46f648
Capabilities:
Accept command line arguments
Connect pipe
Create pipe
Create thread
Delete registry key
Get common file path
Get graphical window text
Hide graphical window
Query environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3590
call fcn.004a5410
push esi
push edi
cmp dword [ebp + 8], 2
jl 0x47b93b
mov dword [ebp - 0x4e0], 0xfffffffd
mov dword [ebp - 0x450], 0x598aaf0a
mov dword [ebp - 0xde4], 0xfffffff9
mov dword [ebp - 0x14], 0
jmp 0x46f68f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x46f6a5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ed8], 0x1c5534bf
jmp 0x46f688
mov dword [ebp - 0x14], 0
jmp 0x46f6b5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x46f6cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c38], 0x1fa4c821
jmp 0x46f6ae
mov dword [ebp - 0x14], 0
jmp 0x46f6db
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x46f6f1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3318], 3
jmp 0x46f6d4
mov dword [ebp - 0x14], 0
jmp 0x46f701
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x46f717
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2048], 1
jmp 0x46f6fa
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1ed8], 0
jne 0x46f733
mov dword [ebp - 0x1eec], 1
jmp 0x46f73a
and dword [ebp - 0x1eec], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x2ae0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ed8]
mov dword [ebp - 0x2d30], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ed8]
mov dword [ebp - 0x31cc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ed8]
cmp dword [ebp - 0x450], eax
jl 0x46f78b
mov dword [ebp - 0x54c], 1
jmp 0x46f792
and dword [ebp - 0x54c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0x1c38], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x54c]
mov dword [ebp + eax - 0x3318], ecx
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0xde4]
add eax, dword [ebp - 0x4e0]
jne 0x46f7e8
cmp dword [ebp - 0x450], 0
jne 0x46f7e8
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3318], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x450]
cmp dword [ebp + eax - 0x1c38], ecx
jge 0x46f809
mov dword [ebp - 0x1c40], 1
jmp 0x46f810
and dword [ebp - 0x1c40], 0
mov eax, dword [ebp - 0x4e0]
cmp dword [ebp - 0x1c40], eax
jle 0x46f82a
mov dword [ebp - 0x1c48], 1
jmp 0x46f831
and dword [ebp - 0x1c48], 0
mov eax, dword [ebp - 0x4e0]
cmp dword [ebp - 0x1c48], eax
jle 0x46f84b
mov dword [ebp - 0x1c50], 1
jmp 0x46f852
and dword [ebp - 0x1c50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1ed8]
cmp dword [ebp - 0x1c50], eax
je 0x46f873
mov dword [ebp - 0x1c58], 1
jmp 0x46f87a
and dword [ebp - 0x1c58], 0
mov eax, dword [ebp - 0x4e0]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x1ed8]
cmp eax, dword [ebp - 0x1c58]
jl 0x46f8a1
mov dword [ebp - 0x1c60], 1
jmp 0x46f8a8
and dword [ebp - 0x1c60], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ed8]
imul eax, dword [ebp - 0x1c60]
test eax, eax
jne 0x46f8d1
mov eax, 0xfa8
test eax, eax
jne 0x46f8d1
and dword [ebp - 0x1c8c], 0
jmp 0x46f8db
mov dword [ebp - 0x1c8c], 1
mov eax, dword [ebp - 0x450]
cmp dword [ebp - 0x1c8c], eax
jl 0x46f8f5
mov dword [ebp - 0x1c94], 1
jmp 0x46f8fc
and dword [ebp - 0x1c94], 0
mov eax, dword [ebp - 0x1c94]
neg eax
cmp eax, dword [ebp - 0x4e0]
jle 0x46f918
mov dword [ebp - 0x1c9c], 1
jmp 0x46f91f
and dword [ebp - 0x1c9c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1ed8]
cmp dword [ebp - 0x1c9c], eax
jne 0x46f93f
mov dword [ebp - 0x1ca4], 1
jmp 0x46f946
and dword [ebp - 0x1ca4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1ca4]
mov dword [ebp + eax - 0x2048], ecx
mov byte [ebp - 0x358], 0
movzx eax, byte [ebp - 0x358]
test eax, eax
je 0x46f979
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - 0x260], 0
jmp 0x46f99c
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xfffffffa
jle 0x46fa4e
mov dword [ebp - 0x7b8], 0xa290be4
mov dword [ebp - 0x2050], 0
cmp dword [ebp - 0x260], 2
jbe 0x46f9d2
mov dword [ebp - 0x1cac], 1
jmp 0x46f9d9
and dword [ebp - 0x1cac], 0
mov eax, dword [ebp - 0x1cac]
mov dword [ebp - 0x7b8], eax
cmp dword [ebp - 0x7b8], 0
jne 0x46fa05
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x7b8], eax
jl 0x46fa05
and dword [ebp - 0x1cb4], 0
jmp 0x46fa0f
mov dword [ebp - 0x1cb4], 1
mov eax, dword [ebp - 0x7b8]
mov ecx, 0xfff8
sub ecx, dword [ebp - 0x260]
sub eax, ecx
cmp dword [ebp - 0x1cb4], eax
je 0x46fa36
mov dword [ebp - 0x1cbc], 1
jmp 0x46fa3d
and dword [ebp - 0x1cbc], 0
mov eax, dword [ebp - 0x1cbc]
mov dword [ebp - 0x2050], eax
jmp 0x46f98f
mov byte [ebp - 0x224], 0
movzx eax, byte [ebp - 0x224]
test eax, eax
je 0x46fa7c
push 0
push 0x1aa6
push 0x1d08
push 0x1a80
push 0xe53
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x2714], 1
mov dword [ebp - 0x2710], 1
mov dword [ebp - 0x270c], 1
mov dword [ebp - 0x2708], 1
lea ecx, [ebp - 0xa75]
call fcn.00433c76
push eax
lea eax, [ebp - 0x2704]
push eax
lea eax, [ebp - 0x2714]
push eax
lea ecx, [ebp - 0x34fc]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3364]
call fcn.00433c25
mov dword [ebp - 0x540], 0xfffffff6
mov dword [ebp - 0x540], 0
jmp 0x46fafc
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 3
jg 0x46fb41
mov byte [ebp - 0x355], 0
movzx eax, byte [ebp - 0x355]
test eax, eax
je 0x46fb3f
push 0
push 0xa4a
push 0xf63
push 0xcf5
push 0x180
push 0xb8a
push 0x639
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x46faef
lea ecx, [ebp - 0x3364]
call fcn.00433c4b
mov dword [ebp - 0x37c], 0xffffffff
push 1
lea ecx, [ebp - 0xae4]
call fcn.00433b79
mov dword [ebp - 0x2060], 0x1eca6c84
mov dword [ebp - 0x2068], 0
mov dword [ebp - 0x50], 0
jmp 0x46fb87
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x46fb9d
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x24bc], 1
jmp 0x46fb80
mov dword [ebp - 0x50], 0
jmp 0x46fbad
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x46fbc9
push dword [ebp - 0x50]
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov dword [eax], 0x6fe7d8a8
jmp 0x46fba6
mov dword [ebp - 0x50], 0
jmp 0x46fbd9
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x46fbef
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x2d38], 0xffffffff
jmp 0x46fbd2
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov dword [eax], 3
jmp 0x46fc28
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov dword [ebp - 0x1cc4], eax
mov eax, dword [ebp - 0x1cc4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1cc4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
cmp dword [eax], 0
jl 0x46fd9e
mov dword [ebp - 0xa94], 0xa0d018d3
mov dword [ebp - 0x1ccc], 0x83a0f0f5
mov byte [ebp - 0x226], 0
movzx eax, byte [ebp - 0x226]
test eax, eax
je 0x46fc75
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x24bc], 0xffffffff
jb 0x46fd86
cmp dword [ebp - 0xa94], 0xffffffff
je 0x46fca7
mov dword [ebp - 0x2058], 1
jmp 0x46fcae
and dword [ebp - 0x2058], 0
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24bc]
mov dword [ebp - 0x30c0], eax
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24bc]
mov dword [ebp - 0x2060], eax
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24bc]
mov dword [ebp - 0x1ccc], eax
mov esi, dword [ebp - 0xa94]
imul edi, dword [ebp - 0x1ccc], 0xe1f6
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24bc]
imul eax, edi
cmp eax, esi
jge 0x46fd3b
mov dword [ebp - 0x1cd4], 1
jmp 0x46fd42
and dword [ebp - 0x1cd4], 0
mov eax, dword [ebp - 0x1cd4]
imul eax, dword [ebp - 0xa94]
mov dword [ebp - 0x1cdc], eax
push 0
lea ecx, [ebp - 0xae4]
call fcn.00433c67
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1cdc]
mov dword [ebp + eax*4 - 0x24bc], ecx
cmp dword [ebp - 0x1cdc], 0
je 0x46fd86
mov dword [ebp - 0x1ce4], 1
jmp 0x46fd8d
and dword [ebp - 0x1ce4], 0
mov eax, dword [ebp - 0x1ce4]
mov dword [ebp - 0x2068], eax
jmp 0x46fc04
lea ecx, [ebp - 0xae4]
call fcn.00433c4b
push 1
lea ecx, [ebp - 0x256c]
call fcn.00433b79
mov dword [ebp - 8], 0xcaf14c90
push 3
lea ecx, [ebp - 0x22dc]
call fcn.00433b79
push 2
lea ecx, [ebp - 0xb58]
call fcn.00433b79
mov dword [ebp - 0x460], 0xc23782e
mov dword [ebp - 0xa14], 0xffffffff
mov dword [ebp - 0xb80], 0xffffffff
mov dword [ebp - 0x2080], 0x4ffad677
mov dword [ebp - 0x104], 0
jmp 0x46fe18
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jge 0x46fe37
push dword [ebp - 0x104]
lea ecx, [ebp - 0x22dc]
call fcn.00433c67
and dword [eax], 0
jmp 0x46fe0b
mov dword [ebp - 0x104], 0
jmp 0x46fe50
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x46fe72
push dword [ebp - 0x104]
lea ecx, [ebp - 0xb58]
call fcn.00433c67
mov dword [eax], 0x9209a488
jmp 0x46fe43
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2d40], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x32a0], eax
cmp dword [ebp - 8], 0x7736
jle 0x46fe99
mov dword [ebp - 0x1cec], 1
jmp 0x46fea0
and dword [ebp - 0x1cec], 0
imul eax, dword [ebp - 0x1cec], 0x3eef
cmp eax, dword [ebp - 8]
jne 0x46febb
mov dword [ebp - 0x1cf4], 1
jmp 0x46fec2
and dword [ebp - 0x1cf4], 0
mov eax, dword [ebp - 0x1cf4]
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 8]
jle 0x46fedc
mov dword [ebp - 0x1cfc], 1
jmp 0x46fee3
and dword [ebp - 0x1cfc], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1cfc], eax
jle 0x46ff03
mov eax, 0xbc43cc9f
test eax, eax
je 0x46ff03
mov dword [ebp - 0x1d04], 1
jmp 0x46ff0a
and dword [ebp - 0x1d04], 0
cmp dword [ebp - 0x1d04], 0xe6c8cac3
jbe 0x46ff22
mov dword [ebp - 0x1d0c], 1
jmp 0x46ff29
and dword [ebp - 0x1d0c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1d0c], eax
je 0x46ff40
mov dword [ebp - 0x1d14], 1
jmp 0x46ff47
and dword [ebp - 0x1d14], 0
push 0
lea ecx, [ebp - 0x22dc]
call fcn.00433c67
mov ecx, dword [ebp - 0x1d14]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x46ff70
mov dword [ebp - 0x2070], 1
jmp 0x46ff77
and dword [ebp - 0x2070], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2d48], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
je 0x46ff94
mov dword [ebp - 0x1d1c], 1
jmp 0x46ff9b
and dword [ebp - 0x1d1c], 0
push 1
lea ecx, [ebp - 0xb58]
call fcn.00433c67
mov ecx, dword [ebp - 0x1d1c]
mov dword [eax], ecx
mov esi, dword [ebp - 8]
push 0
lea ecx, [ebp - 0xb58]
call fcn.00433c67
mov eax, dword [eax]
sub eax, dword [ebp - 8]
sub esi, eax
cmp esi, dword [ebp - 8]
jl 0x46ffd8
mov dword [ebp - 0x1dc0], 1
jmp 0x46ffdf
and dword [ebp - 0x1dc0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1dc0], eax
jne 0x46fff6
mov dword [ebp - 0x1dc8], 1
jmp 0x46fffd
and dword [ebp - 0x1dc8], 0
mov eax, dword [ebp - 0x1dc8]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0
jne 0x470021
cmp dword [ebp - 8], 0
jne 0x470021
and dword [ebp - 0x1dd0], 0
jmp 0x47002b
mov dword [ebp - 0x1dd0], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1dd0], eax
jl 0x470042
mov dword [ebp - 0x1a14], 1
jmp 0x470049
and dword [ebp - 0x1a14], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0x1a14]
mov dword [ebp - 0xa14], eax
push 1
lea ecx, [ebp - 0xb58]
call fcn.00433c67
cmp dword [eax], 0
je 0x4701a9
mov dword [ebp - 0xb80], 1
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xb80], eax
je 0x470090
mov dword [ebp - 0x1a1c], 1
jmp 0x470097
and dword [ebp - 0x1a1c], 0
imul eax, dword [ebp - 0x1a1c], 0x6cf
test eax, eax
jge 0x4700b1
mov dword [ebp - 0xb88], 1
jmp 0x4700b8
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0xa14]
cmp dword [ebp - 0xb88], eax
jge 0x4700d2
mov dword [ebp - 0x90c], 1
jmp 0x4700d9
and dword [ebp - 0x90c], 0
push 2
lea ecx, [ebp - 0x22dc]
call fcn.00433c67
mov ecx, dword [ebp - 0x90c]
mov dword [eax], ecx
cmp dword [ebp - 0x90c], 0
jne 0x470115
push 0
lea ecx, [ebp - 0x22dc]
call fcn.00433c67
cmp dword [eax], 0
je 0x470115
mov dword [ebp - 0x1a24], 1
jmp 0x47011c
and dword [ebp - 0x1a24], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1a24]
jge 0x470133
mov dword [ebp - 0x2078], 1
jmp 0x47013a
and dword [ebp - 0x2078], 0
push 0
lea ecx, [ebp - 0xb58]
call fcn.00433c67
mov esi, dword [ebp - 0x460]
push 1
lea ecx, [ebp - 0xb58]
call fcn.00433c67
cmp esi, dword [eax]
jne 0x47016a
mov dword [ebp - 0xb90], 1
jmp 0x470171
and dword [ebp - 0xb90], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0xb90], eax
jne 0x47018b
mov dword [ebp - 0x1a2c], 1
jmp 0x470192
and dword [ebp - 0x1a2c], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x1a2c]
jne 0x4701a9
mov dword [ebp - 0xb98], 1
jmp 0x4701b0
and dword [ebp - 0xb98], 0
cmp dword [ebp - 0xb98], 0
jbe 0x4701c5
mov dword [ebp - 0x1a34], 1
jmp 0x4701cc
and dword [ebp - 0x1a34], 0
mov eax, dword [ebp - 0xa14]
cmp dword [ebp - 0x1a34], eax
jle 0x4701e6
mov dword [ebp - 0xba0], 1
jmp 0x4701ed
and dword [ebp - 0xba0], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xba0], eax
je 0x470204
mov dword [ebp - 0x1a3c], 1
jmp 0x47020b
and dword [ebp - 0x1a3c], 0
cmp dword [ebp - 0x1a3c], 0
je 0x470220
mov dword [ebp - 0xba8], 1
jmp 0x470227
and dword [ebp - 0xba8], 0
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0x460], eax
mov esi, dword [ebp - 0x2080]
push 1
lea ecx, [ebp - 0xb58]
call fcn.00433c67
cmp esi, dword [eax]
jg 0x470256
mov dword [ebp - 0x1a44], 1
jmp 0x47025d
and dword [ebp - 0x1a44], 0
push 0
lea ecx, [ebp - 0xb58]
call fcn.00433c67
mov ecx, dword [ebp - 0x1a44]
mov dword [eax], ecx
lea ecx, [ebp - 0xb58]
call fcn.00433c4b
lea ecx, [ebp - 0x22dc]
call fcn.00433c4b
mov dword [ebp - 0x30c8], 0xf592758e
mov dword [ebp - 0xf4], 0xa3622ba3
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x2194], 4
cmp dword [ebp - 0xf4], 0
je 0x47032b
mov dword [ebp - 0xbb0], 0x7e17f759
mov dword [ebp - 0x2088], 5
mov dword [ebp - 0x2090], 0x47adf1ad
cmp dword [ebp - 0xbb0], 0
je 0x4702fd
mov eax, dword [ebp - 0xbb0]
imul eax, dword [ebp - 0xf4]
test eax, eax
je 0x4702fd
mov dword [ebp - 0x1a4c], 1
jmp 0x470304
and dword [ebp - 0x1a4c], 0
mov eax, dword [ebp - 0x1a4c]
mov dword [ebp - 0x2088], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x2d50], eax
mov dword [ebp - 0x2090], 0xfffffff6
jmp 0x4704a3
mov dword [ebp - 0x914], 0xffffffff
mov dword [ebp - 0x4b8], 0x88a97331
mov dword [ebp - 0xb0c], 9
cmp dword [ebp - 0x914], 1
jb 0x47035e
mov dword [ebp - 0xbb8], 1
jmp 0x470365
and dword [ebp - 0xbb8], 0
cmp dword [ebp - 0xbb8], 0
je 0x47037a
mov dword [ebp - 0x1a54], 1
jmp 0x470381
and dword [ebp - 0x1a54], 0
mov eax, dword [ebp - 0x914]
imul ecx, dword [ebp - 0x1a54], 0xffffffff
imul ecx, dword [ebp - 0xf4]
imul ecx, ecx, 0x874d
imul eax, ecx
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
cmp dword [ebp - 0xf4], eax
jle 0x4703be
mov dword [ebp - 0xbc0], 1
jmp 0x4703c5
and dword [ebp - 0xbc0], 0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x31e0], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x2d58], eax
or eax, 0xffffffff
je 0x4703f5
cmp dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x4b8]
imul eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0xf4]
mov dword [ebp - 0x6e8], eax
push 7
pop eax
test eax, eax
je 0x470490
mov eax, dword [ebp - 0x6e8]
neg eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 1
jg 0x470438
mov dword [ebp - 0x1a5c], 1
jmp 0x47043f
and dword [ebp - 0x1a5c], 0
cmp dword [ebp - 0x1a5c], 0x4a0435e4
jle 0x470457
mov dword [ebp - 0x2098], 1
jmp 0x47045e
and dword [ebp - 0x2098], 0
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0x30d0], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x4b8], eax
jge 0x470490
mov dword [ebp - 0xbc8], 1
jmp 0x470497
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x2194], eax
mov byte [ebp - 0x321], 0
movzx eax, byte [ebp - 0x321]
test eax, eax
je 0x4704c4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0x94c], 0xd40a1650
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0x1a74], 0xe34aafbe
mov dword [ebp - 0x548], 0
jmp 0x4704fb
mov eax, dword [ebp - 0x548]
inc eax
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 4
jge 0x470517
mov eax, dword [ebp - 0x548]
mov dword [ebp + eax*4 - 0x268c], 0x9b55
jmp 0x4704ee
mov dword [ebp - 0x190], 0
jmp 0x470530
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jg 0x4706cf
mov dword [ebp - 0xa1c], 0xfffffff7
mov dword [ebp - 0x91c], 0xffffffff
mov dword [ebp - 0x21a4], 0xdb370cc3
mov eax, dword [ebp - 0x190]
cmp dword [ebp + eax*4 - 0x268c], 0xffffffff
je 0x470577
mov dword [ebp - 0xbe0], 1
jmp 0x47057e
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x2d60], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x268c]
mov dword [ebp - 0xa1c], eax
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp + eax*4 - 0x268c]
cmp dword [ebp - 0xa1c], eax
je 0x4705bd
mov dword [ebp - 0x1a64], 1
jmp 0x4705c4
and dword [ebp - 0x1a64], 0
imul eax, dword [ebp - 0x1a64], 0xf885
cmp eax, 0x498d20b
jne 0x4705e1
mov dword [ebp - 0xbd0], 1
jmp 0x4705e8
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp + eax*4 - 0x268c]
cmp dword [ebp - 0xbd0], eax
jne 0x470609
mov dword [ebp - 0x1a6c], 1
jmp 0x470610
and dword [ebp - 0x1a6c], 0
mov eax, dword [ebp - 0x1a6c]
inc eax
cmp eax, dword [ebp - 0x91c]
jle 0x47062b
mov dword [ebp - 0xbd8], 1
jmp 0x470632
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x91c]
add eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x1a74], eax
mov eax, dword [ebp - 0x1a74]
cmp dword [ebp - 0xbe0], eax
jge 0x47065e
mov dword [ebp - 0x1a7c], 1
jmp 0x470665
and dword [ebp - 0x1a7c], 0
cmp dword [ebp - 0x1a7c], 1
je 0x47067a
mov dword [ebp - 0x219c], 1
jmp 0x470681
and dword [ebp - 0x219c], 0
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x32fc], eax
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x190]
cmp dword [ebp + eax*4 - 0x268c], ecx
jle 0x4706b4
mov eax, 0xffff
test eax, eax
jne 0x4706b4
and dword [ebp - 0xbe8], 0
jmp 0x4706be
mov dword [ebp - 0xbe8], 1
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x21a4], eax
jmp 0x470523
mov dword [ebp - 0x247c], 2
and dword [ebp - 0x2854], 0
and dword [ebp - 0x2850], 0
and dword [ebp - 0x284c], 0
and dword [ebp - 0x2848], 0
lea ecx, [ebp - 0xa7d]
call fcn.00433c76
push eax
lea eax, [ebp - 0x2844]
push eax
lea eax, [ebp - 0x2854]
push eax
lea ecx, [ebp - 0x34e4]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2910]
call fcn.00433c25
push 2
lea ecx, [ebp - 0xb70]
call fcn.00433b79
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x2d68], 0xffffffff
mov dword [ebp - 0x30d8], 3
mov dword [ebp - 0x2d70], 0x5da2ca33
mov dword [ebp - 0x31f4], 0xfffffffa
mov dword [ebp - 0x10c], 0
jmp 0x470782
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x4707a4
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xb70]
call fcn.00433c67
mov dword [eax], 0x29000d4e
jmp 0x470775
mov dword [ebp - 0x10c], 0
jmp 0x4707bd
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x4707d9
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x264c], 0xcd04
jmp 0x4707b0
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
and dword [eax], 0
jmp 0x47080f
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
mov dword [ebp - 0x1a84], eax
mov eax, dword [ebp - 0x1a84]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a84]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
cmp dword [eax], 3
jg 0x4709d4
mov dword [ebp - 0x2d78], 0xfffffff7
mov dword [ebp - 0x30e0], 0xfffffff6
mov dword [ebp - 0x2d80], 1
mov dword [ebp - 0x32a8], 0
mov dword [ebp - 0x2d88], 2
mov dword [ebp - 0x30e8], 0xba8d7d2a
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
push dword [eax]
lea ecx, [ebp - 0x2910]
call fcn.00433c67
mov esi, eax
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x47089c
mov dword [ebp - 0xbf0], 1
jmp 0x4708a3
and dword [ebp - 0xbf0], 0
cmp dword [ebp - 0xbf0], 3
jg 0x4708b8
mov dword [ebp - 0x1a8c], 1
jmp 0x4708bf
and dword [ebp - 0x1a8c], 0
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
imul esi, dword [eax], 0x59a3b216
push 1
lea ecx, [ebp - 0xb70]
call fcn.00433c67
push dword [eax]
lea ecx, [ebp - 0x2910]
call fcn.00433c67
cmp esi, dword [eax]
jg 0x4708fc
mov dword [ebp - 0xbf8], 1
jmp 0x470903
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x1a8c]
cmp eax, dword [ebp - 0xbf8]
jl 0x47091d
mov dword [ebp - 0x1a94], 1
jmp 0x470924
and dword [ebp - 0x1a94], 0
mov eax, dword [ebp - 0x1a94]
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x468], 0
jmp 0x470949
mov eax, dword [ebp - 0x468]
inc eax
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 3
jg 0x4709cf
mov dword [ebp - 0x30fc], 0xfffffffb
push 2
lea ecx, [ebp - 0x2de8]
call fcn.00433b79
mov dword [ebp - 0x858], 0
jmp 0x470982
mov eax, dword [ebp - 0x858]
inc eax
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 2
jge 0x4709a4
push dword [ebp - 0x858]
lea ecx, [ebp - 0x2de8]
call fcn.00433c67
mov dword [eax], 0x11aa84cb
jmp 0x470975
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x264c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x264c], eax
lea ecx, [ebp - 0x2de8]
call fcn.00433c4b
jmp 0x47093c
jmp 0x4707eb
lea ecx, [ebp - 0xb70]
call fcn.00433c4b
lea ecx, [ebp - 0x2910]
call fcn.00433c4b
mov dword [ebp - 0xe40], 0
mov dword [ebp - 0x4f8], 0xfffffff8
mov dword [ebp - 0x550], 0
jmp 0x470a17
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 4
jge 0x470a33
mov eax, dword [ebp - 0x550]
mov dword [ebp + eax*4 - 0x34d4], 0x88d0d3f7
jmp 0x470a0a
mov dword [ebp - 0x4f8], 5
jmp 0x470a4c
mov eax, dword [ebp - 0x4f8]
dec eax
mov dword [ebp - 0x4f8], eax
cmp dword [ebp - 0x4f8], 0xffffffe3
jg 0x470b12
push 3
lea ecx, [ebp - 0x2928]
call fcn.00433b79
mov dword [ebp - 0x1b8], 0
jmp 0x470a7f
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 2
jge 0x470a9b
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x2d94], 0x905d
jmp 0x470a72
mov dword [ebp - 0x1b8], 0
jmp 0x470ab4
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x470ad3
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x2928]
call fcn.00433c67
and dword [eax], 0
jmp 0x470aa7
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x2d94]
push 1
lea ecx, [ebp - 0x2928]
call fcn.00433c67
mov dword [eax], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f8]
mov dword [ebp + eax - 0x34d4], ecx
lea ecx, [ebp - 0x2928]
call fcn.00433c4b
jmp 0x470a3f
mov dword [ebp - 0x2dbc], 1
mov dword [ebp - 0x6f0], 0xfffffffe
mov dword [ebp - 0x3220], 0x3e90a624
mov dword [ebp - 0x2dc4], 0x21ded680
push 1
lea ecx, [ebp - 0x2e18]
call fcn.00433b79
mov dword [ebp - 0x38], 0
jmp 0x470b57
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x470b6d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3464], 0xfffffffa
jmp 0x470b50
mov dword [ebp - 0x38], 0
jmp 0x470b7d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x470b96
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2e18]
call fcn.00433c67
and dword [eax], 0
jmp 0x470b76
mov dword [ebp - 0x38], 0
jmp 0x470ba6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x470bbc
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x267c], 0x74ca7790
jmp 0x470b9f
mov dword [ebp - 0x6f0], 0xfffffffd
jmp 0x470bd5
mov eax, dword [ebp - 0x6f0]
inc eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 9
jne 0x470cbe
push 1
lea ecx, [ebp - 0x2e08]
call fcn.00433b79
push 4
lea ecx, [ebp - 0x2df8]
call fcn.00433b79
mov dword [ebp - 0xc00], 0xffff
mov dword [ebp - 0x114], 0
jmp 0x470c1f
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x470c41
push dword [ebp - 0x114]
lea ecx, [ebp - 0x2e08]
call fcn.00433c67
mov dword [eax], 0x647d
jmp 0x470c12
mov dword [ebp - 0x114], 0
jmp 0x470c5a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x470c7c
push dword [ebp - 0x114]
lea ecx, [ebp - 0x2df8]
call fcn.00433c67
mov dword [eax], 0xfffffffc
jmp 0x470c4d
mov eax, dword [ebp - 0xc00]
dec eax
mov dword [ebp - 0xc00], eax
mov byte [ebp - 0x228], 0
movzx eax, byte [ebp - 0x228]
test eax, eax
je 0x470ca3
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
lea ecx, [ebp - 0x2df8]
call fcn.00433c4b
lea ecx, [ebp - 0x2e08]
call fcn.00433c4b
jmp 0x470bc8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x267c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x267c], eax
lea ecx, [ebp - 0x2e18]
call fcn.00433c4b
mov dword [ebp - 0x3104], 0xd580090a
mov dword [ebp - 0x7c0], 0x91a049fe
mov dword [ebp - 0x2dcc], 0xf84b8114
mov dword [ebp - 0x558], 0
jmp 0x470d1b
mov eax, dword [ebp - 0x558]
inc eax
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 4
jge 0x470d37
mov eax, dword [ebp - 0x558]
mov dword [ebp + eax*4 - 0x3554], 0x39ed080c
jmp 0x470d0e
mov dword [ebp - 0x7c0], 0xfffffffa
jmp 0x470d50
mov eax, dword [ebp - 0x7c0]
dec eax
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x7c0], 0xffffffed
je 0x470e3d
mov dword [ebp - 0x2a28], 1
mov dword [ebp - 0x2a2c], 0x653d4237
mov dword [ebp - 0x2a34], 0xcc25bfc8
mov dword [ebp - 0x2a3c], 0x64276038
mov dword [ebp - 0x2a44], 0xda7ef5d8
mov dword [ebp - 0x2a4c], 0x969ac54c
mov dword [ebp - 0x2a54], 0xfffffff6
mov dword [ebp - 0x2a5c], 0xfffffff6
mov dword [ebp - 0x2a64], 0xe713e19f
mov dword [ebp - 0x2a6c], 1
push 4
lea ecx, [ebp - 0x2940]
call fcn.00433b79
mov dword [ebp - 0x560], 0
jmp 0x470de7
mov eax, dword [ebp - 0x560]
inc eax
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x560], 4
jge 0x470e09
push dword [ebp - 0x560]
lea ecx, [ebp - 0x2940]
call fcn.00433c67
mov dword [eax], 0xd8af
jmp 0x470dda
push 3
lea ecx, [ebp - 0x2940]
call fcn.00433c67
mov dword [ebp - 0x1a9c], eax
mov eax, dword [ebp - 0x1a9c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1a9c]
mov dword [ecx], eax
lea ecx, [ebp - 0x2940]
call fcn.00433c4b
jmp 0x470d43
mov dword [ebp - 0x470], 0x5f88e10e
mov dword [ebp - 0xc40], 0xa74db503
mov dword [ebp - 0x21bc], 0xbdd1
mov dword [ebp - 0x21c4], 0xddf936bb
mov dword [ebp - 0x6f8], 0
jmp 0x470e7e
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 2
jge 0x470e9a
mov eax, dword [ebp - 0x6f8]
mov dword [ebp + eax*4 - 0x1c6c], 0xc45cdbe8
jmp 0x470e71
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c6c], 0
je 0x4710da
mov dword [ebp - 0x360], 0x318d5816
mov byte [ebp - 0x357], 0
movzx eax, byte [ebp - 0x357]
test eax, eax
je 0x470ee5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x360], 0
jmp 0x470efe
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0xffffffe3
jle 0x4710d5
mov dword [ebp - 0x568], 0x5dae5a6
mov dword [ebp - 0x410], 0x73417203
mov dword [ebp - 0x21ac], 0x2db7
mov dword [ebp - 0x568], 0
jmp 0x470f42
mov eax, dword [ebp - 0x568]
inc eax
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0x17
jle 0x471082
mov dword [ebp - 0x828], 0xfffffffc
mov dword [ebp - 0x31b4], 0x8fe24307
mov dword [ebp - 0x31b0], 0x8fe24307
mov dword [ebp - 0x31ac], 0x8fe24307
mov dword [ebp - 0x31a8], 0x8fe24307
mov dword [ebp - 0x828], 1
jmp 0x470f9a
mov eax, dword [ebp - 0x828]
dec eax
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x828], 0
jl 0x47107d
mov dword [ebp - 0x2a74], 0x2324015f
xor eax, eax
jne 0x470fec
imul eax, dword [ebp - 0x470], 0xa22
mov ecx, dword [ebp - 0x470]
inc ecx
mov dword [ebp - 0x470], ecx
test eax, eax
jne 0x470fe2
cmp dword [ebp - 0x470], 0
jg 0x470fe2
and dword [ebp - 0xc08], 0
jmp 0x470fec
mov dword [ebp - 0xc08], 1
cmp dword [ebp - 0x360], 0
jne 0x471007
cmp dword [ebp - 0x360], 0
jne 0x471007
and dword [ebp - 0x1aa4], 0
jmp 0x471011
mov dword [ebp - 0x1aa4], 1
mov eax, dword [ebp - 0x1aa4]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x21ac], eax
mov dword [ebp - 0x410], 0
jmp 0x471042
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 1
jg 0x471078
mov byte [ebp - 0x22a], 0
movzx eax, byte [ebp - 0x22a]
test eax, eax
je 0x471076
push 0
push 0x212d
push 0x240
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x471035
jmp 0x470f8d
jmp 0x470f35
mov byte [ebp - 0x329], 0
movzx eax, byte [ebp - 0x329]
test eax, eax
je 0x4710d0
push 0x1122
push 0x111d
push 0x245c
push 0x2544
push 0x21b2
push 0x13fd
push 0x10e4
push 0x244d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x470ef1
jmp 0x47133b
mov dword [ebp - 0x1ad4], 0xae86a676
mov dword [ebp - 0x924], 5
mov dword [ebp - 0x1ab4], 0xcc8c
mov dword [ebp - 0x570], 0
jmp 0x471111
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 4
jge 0x47112d
mov eax, dword [ebp - 0x570]
mov dword [ebp + eax*4 - 0x3328], 0x6069
jmp 0x471104
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c6c], 0x4bae914
jge 0x47114c
mov dword [ebp - 0xc10], 1
jmp 0x471153
and dword [ebp - 0xc10], 0
mov eax, dword [ebp - 0x1ab4]
cmp dword [ebp - 0xc10], eax
jl 0x47116d
mov dword [ebp - 0x1aac], 1
jmp 0x471174
and dword [ebp - 0x1aac], 0
mov eax, dword [ebp - 0x924]
cmp eax, dword [ebp - 0x1aac]
jge 0x47118e
mov dword [ebp - 0xc18], 1
jmp 0x471195
and dword [ebp - 0xc18], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c6c]
cmp eax, dword [ebp - 0xc18]
jl 0x4711b6
mov dword [ebp - 0x21b4], 1
jmp 0x4711bd
and dword [ebp - 0x21b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3328]
mov dword [ebp - 0x2a7c], eax
mov eax, 0xed69
sub eax, dword [ebp - 0x470]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c6c]
jne 0x4711f6
mov dword [ebp - 0xc20], 1
jmp 0x4711fd
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0x1ab4]
cmp dword [ebp - 0xc20], eax
je 0x471217
mov dword [ebp - 0x1abc], 1
jmp 0x47121e
and dword [ebp - 0x1abc], 0
cmp dword [ebp - 0x1abc], 8
ja 0x471233
mov dword [ebp - 0xc28], 1
jmp 0x47123a
and dword [ebp - 0xc28], 0
cmp dword [ebp - 0xc28], 1
je 0x47124f
mov dword [ebp - 0x1ac4], 1
jmp 0x471256
and dword [ebp - 0x1ac4], 0
mov eax, dword [ebp - 0x924]
add eax, dword [ebp - 0x1ac4]
cmp eax, dword [ebp - 0x924]
jge 0x471276
mov dword [ebp - 0xc30], 1
jmp 0x47127d
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x21bc]
cmp dword [ebp - 0xc30], eax
jl 0x471297
mov dword [ebp - 0x1acc], 1
jmp 0x47129e
and dword [ebp - 0x1acc], 0
cmp dword [ebp - 0x1acc], 0x8b3176a1
jae 0x4712b6
mov dword [ebp - 0xc38], 1
jmp 0x4712bd
and dword [ebp - 0xc38], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3328]
cmp dword [ebp - 0xc38], eax
jl 0x4712de
mov dword [ebp - 0x1adc], 1
jmp 0x4712e5
and dword [ebp - 0x1adc], 0
mov dword [ebp - 0x1ad4], 0x642e5f0e
mov eax, dword [ebp - 0x1ad4]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0xc40]
add eax, 0xa
sub eax, dword [ebp - 0x1adc]
jne 0x471325
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c6c], 0
jne 0x471325
and dword [ebp - 0xc48], 0
jmp 0x47132f
mov dword [ebp - 0xc48], 1
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0x21c4], eax
mov dword [ebp - 0x700], 0
jmp 0x471354
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 1
jge 0x471376
push dword [ebp - 0x700]
lea ecx, [ebp - 0x256c]
call fcn.00433c67
mov dword [eax], 0x3cdf98a5
jmp 0x471347
push 1
lea ecx, [ebp - 0x1ddc]
call fcn.00433b79
mov dword [ebp - 0x21dc], 0x2aba
mov dword [ebp - 0x198], 0
jmp 0x4713a6
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x4713c8
push dword [ebp - 0x198]
lea ecx, [ebp - 0x1ddc]
call fcn.00433c67
mov dword [eax], 0xfffffff6
jmp 0x471399
mov dword [ebp - 0x198], 0
jmp 0x4713e1
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x4713fd
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0xb28], 0x53606de7
jmp 0x4713d4
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb28], 0
jmp 0x47142b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb28]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xb28], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb28], 0
jl 0x471581
mov dword [ebp - 0x21d4], 0xfffffffd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x2a84], eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0xb28]
lea ecx, [ebp - 0x1ddc]
call fcn.00433c67
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x2a8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x2a94], eax
mov eax, 0xf2ba167c
test eax, eax
jne 0x4714bb
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xb28], 0
jne 0x4714bb
and dword [ebp - 0x1ae4], 0
jmp 0x4714c5
mov dword [ebp - 0x1ae4], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xb28]
cmp dword [ebp - 0x1ae4], eax
jge 0x4714e6
mov dword [ebp - 0xc50], 1
jmp 0x4714ed
and dword [ebp - 0xc50], 0
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0xb28]
lea ecx, [ebp - 0x1ddc]
call fcn.00433c67
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xb28]
add ecx, dword [ebp - 0xc50]
push 4
pop edx
imul edx, edx, 3
sub ecx, dword [ebp + edx - 0xb28]
cmp dword [eax], ecx
jg 0x471535
mov dword [ebp - 0x21cc], 1
jmp 0x47153c
and dword [ebp - 0x21cc], 0
push 0
lea ecx, [ebp - 0x1ddc]
call fcn.00433c67
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb28]
mov dword [ebp - 0x2a9c], eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0xb28]
lea ecx, [ebp - 0x1ddc]
call fcn.00433c67
mov eax, dword [eax]
mov dword [ebp - 0x21d4], eax
jmp 0x471410
push 0
lea ecx, [ebp - 0x1ddc]
call fcn.00433c67
mov eax, dword [eax]
mov dword [ebp - 0x21dc], eax
lea ecx, [ebp - 0x1ddc]
call fcn.00433c4b
mov dword [ebp - 0x37c], 0xffffffe6
jmp 0x4715ba
cmp dword [ebp - 0x37c], 0xa
je 0x474d05
mov dword [ebp - 0xa9c], 0xfffffffe
mov dword [ebp - 0x1c8], 0xade2167f
mov dword [ebp - 0x2aa4], 0xef9f3b06
mov eax, dword [ebp - 0xa9c]
cmp dword [ebp - 0xa9c], eax
je 0x4715ff
mov dword [ebp - 0x1aec], 1
jmp 0x471606
and dword [ebp - 0x1aec], 0
mov eax, dword [ebp - 0x1aec]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
je 0x471870
mov dword [ebp - 0x92c], 0xffffffff
mov dword [ebp - 0x2aac], 0
mov dword [ebp - 0x2ab4], 0x205300ce
mov dword [ebp - 0x2abc], 0xfffffff8
mov dword [ebp - 0x2ac4], 0x4879
mov dword [ebp - 0x2acc], 0xfffffffc
mov dword [ebp - 0x2ad4], 0xfffffffa
mov dword [ebp - 0x273c], 0xf5ff74f5
mov dword [ebp - 0x2738], 0xf5ff74f5
mov dword [ebp - 0x2734], 0xf5ff74f5
mov dword [ebp - 0x2730], 0xf5ff74f5
lea ecx, [ebp - 0xa6d]
call fcn.00433c76
push eax
lea eax, [ebp - 0x272c]
push eax
lea eax, [ebp - 0x273c]
push eax
lea ecx, [ebp - 0x33fc]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2e38]
call fcn.00433c25
mov eax, dword [ebp - 0x92c]
sub eax, dword [ebp - 0x1c8]
je 0x4717ce
mov dword [ebp - 0x578], 0xeb4c
mov dword [ebp - 0x21ec], 0xfffffff6
mov dword [ebp - 0x578], 0
cmp dword [ebp - 0x1c8], 0xaf5bfb66
jae 0x471716
mov dword [ebp - 0xc58], 1
jmp 0x47171d
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0x578]
cmp eax, dword [ebp - 0xc58]
jl 0x471737
mov dword [ebp - 0x21e4], 1
jmp 0x47173e
and dword [ebp - 0x21e4], 0
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x2adc], eax
cmp dword [ebp - 0xa9c], 0x8633
jne 0x471762
mov dword [ebp - 0x1af4], 1
jmp 0x471769
and dword [ebp - 0x1af4], 0
mov eax, dword [ebp - 0x578]
cmp dword [ebp - 0x1af4], eax
jl 0x471783
mov dword [ebp - 0xc60], 1
jmp 0x47178a
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x92c]
add eax, dword [ebp - 0xc60]
imul eax, dword [ebp - 0x578]
test eax, eax
jne 0x4717b3
cmp dword [ebp - 0x1c8], 0
jne 0x4717b3
and dword [ebp - 0x1afc], 0
jmp 0x4717bd
mov dword [ebp - 0x1afc], 1
mov eax, dword [ebp - 0x1afc]
mov dword [ebp - 0x21ec], eax
jmp 0x471863
mov dword [ebp - 0x2ae4], 0
mov dword [ebp - 0x2aec], 0xfffffffd
mov dword [ebp - 0x2af4], 0xfffffff8
push 4
lea ecx, [ebp - 0x2e28]
call fcn.00433b79
mov dword [ebp - 0x7c8], 0
jmp 0x471812
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 4
jge 0x471834
push dword [ebp - 0x7c8]
lea ecx, [ebp - 0x2e28]
call fcn.00433c67
mov dword [eax], 0xef8169c1
jmp 0x471805
push 2
lea ecx, [ebp - 0x2e38]
call fcn.00433c67
mov dword [ebp - 0xc68], eax
mov eax, dword [ebp - 0xc68]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc68]
mov dword [ecx], eax
lea ecx, [ebp - 0x2e28]
call fcn.00433c4b
lea ecx, [ebp - 0x2e38]
call fcn.00433c4b
jmp 0x4718bb
mov dword [ebp - 0x1b04], 0xfffffffb
mov dword [ebp - 0x21f4], 0x21f997ec
mov dword [ebp - 0x1b04], 0x2e25
mov eax, dword [ebp - 0x21f4]
cmp dword [ebp - 0x1b04], eax
jne 0x4718a8
mov dword [ebp - 0xc70], 1
jmp 0x4718af
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x280], 0xefc07e17
push 2
lea ecx, [ebp - 0x250c]
call fcn.00433b79
mov dword [ebp - 0x36c], 0xfffffff7
mov dword [ebp - 0x2afc], 3
mov dword [ebp - 0x580], 0
jmp 0x4718ff
mov eax, dword [ebp - 0x580]
inc eax
mov dword [ebp - 0x580], eax
cmp dword [ebp - 0x580], 2
jge 0x471921
push dword [ebp - 0x580]
lea ecx, [ebp - 0x250c]
call fcn.00433c67
mov dword [eax], 0xfffffffd
jmp 0x4718f2
mov dword [ebp - 0x36c], 0
jmp 0x47193a
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 1
jg 0x471a13
mov dword [ebp - 0x708], 0
mov dword [ebp - 0x2b04], 0xfffffffb
mov dword [ebp - 0x2b0c], 0x6715f0ed
mov dword [ebp - 0x2b14], 0xbedcc590
mov dword [ebp - 0x708], 0
jmp 0x471988
cmp dword [ebp - 0x708], 1
jg 0x471a0e
mov dword [ebp - 0x588], 0
jmp 0x4719aa
cmp dword [ebp - 0x588], 2
jge 0x4719c6
jmp 0x47192d
lea ecx, [ebp - 0x250c]
call fcn.00433c4b
mov dword [ebp - 0x248c], 0xbce008fb
mov dword [ebp - 0x590], 6
mov dword [ebp - 0x2b1c], 0xfffffff7
mov dword [ebp - 0x884], 0
jmp 0x471a55
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 4
jge 0x471a71
mov eax, dword [ebp - 0x884]
mov dword [ebp + eax*4 - 0x3454], 0xffffffff
jmp 0x471a48
mov byte [ebp - 0x22c], 0
movzx eax, byte [ebp - 0x22c]
test eax, eax
je 0x471a94
push 0
push 0
push 0x219a
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
mov dword [ebp - 0x590], 0
jmp 0x471aad
lea ecx, [ebp - 0x256c]
call fcn.00433c4b
push 2
lea ecx, [ebp - 0x2584]
call fcn.00433b79
mov dword [ebp - 0xd0], 0x490c4d8e
mov dword [ebp - 0xed0], 0
mov dword [ebp - 0x1efc], 1
mov dword [ebp - 0x608], 0
jmp 0x474d54
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 2
jge 0x474d76
push dword [ebp - 0x608]
lea ecx, [ebp - 0x2584]
call fcn.00433c67
mov dword [eax], 0xd3df
jmp 0x474d47
mov dword [ebp - 0xd0], 0
jmp 0x474d8f
cmp dword [ebp - 0xd0], 1
jg 0x4751b2
push 1
lea ecx, [ebp - 0x8e8]
call fcn.00433b79
mov dword [ebp - 0xa34], 0
mov dword [ebp - 0xe98], 0x2625aa9c
mov dword [ebp - 0x878], 0
jmp 0x474dd6
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 1
jge 0x474df8
push dword [ebp - 0x878]
lea ecx, [ebp - 0x8e8]
call fcn.00433c67
mov dword [eax], 0x60edac7a
jmp 0x474dc9
push 0
lea ecx, [ebp - 0x8e8]
call fcn.00433c67
cmp dword [eax], 0xfffffffb
jbe 0x474e16
mov dword [ebp - 0x1620], 1
jmp 0x474e1d
and dword [ebp - 0x1620], 0
push 0
lea ecx, [ebp - 0x8e8]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1620]
jge 0x474e40
mov dword [ebp - 0x19f8], 1
jmp 0x474e47
and dword [ebp - 0x19f8], 0
push 0
lea ecx, [ebp - 0x8e8]
call fcn.00433c67
cmp dword [eax], 0x1ee01e6e
jge 0x474e68
mov dword [ebp - 0xe88], 1
jmp 0x474e6f
and dword [ebp - 0xe88], 0
cmp dword [ebp - 0xe88], 0xffffffff
jne 0x474e84
mov dword [ebp - 0x19f0], 1
jmp 0x474e8b
and dword [ebp - 0x19f0], 0
mov eax, dword [ebp - 0x19f0]
mov dword [ebp - 0xa34], eax
mov esi, dword [ebp - 0xa34]
push 0
lea ecx, [ebp - 0x8e8]
call fcn.00433c67
cmp esi, dword [eax]
jg 0x474eba
lea ecx, [ebp - 0x2584]
call fcn.00433c4b
push 1
lea eax, [ebp - 0x3538]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0046bd05
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x33b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x33b8]
lea edi, [ebp - 0x2590]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x610], 0
jmp 0x475205
mov eax, dword [ebp - 0x610]
inc eax
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x610], 2
jge 0x475221
mov eax, dword [ebp - 0x610]
mov dword [ebp + eax*4 - 0x1e30], 0
jmp 0x4751f8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1e30], 0xfffffffd
jmp 0x47524f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e30]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1e30], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e30], 4
je 0x47527b
mov byte [ebp - 0x33c], 0
movzx eax, byte [ebp - 0x33c]
test eax, eax
je 0x475279
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
jmp 0x475234
mov dword [ebp - 0x480], 0x5f88e10e
mov dword [ebp - 0x1668], 0xa74db503
mov dword [ebp - 0x22e0], 0xbdd1
mov dword [ebp - 0x1f0c], 0xddf936bb
mov dword [ebp - 0x750], 0
jmp 0x4752bc
cmp dword [ebp - 0x750], 2
jge 0x4752d8
mov eax, dword [ebp - 0x750]
mov dword [ebp + eax*4 - 0x1c78], 0xc45cdbe8
jmp 0x4752af
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c78], 0
je 0x475518
cmp dword [ebp + 8], 1
jne 0x4828ab
mov dword [ebp - 0x584], 0xa61928c1
mov byte [ebp - 0x337], 0
movzx eax, byte [ebp - 0x337]
test eax, eax
je 0x47b975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov dword [ebp - 0x584], 0xc
jmp 0x47b98e
mov eax, dword [ebp - 0x584]
dec eax
mov dword [ebp - 0x584], eax
cmp dword [ebp - 0x584], 0xffffffe5
jge 0x47b9b9
mov dword [ebp - 0x210c], 0x9cfe0482
mov dword [ebp - 0x2054], 0
mov eax, dword [ebp - 0x210c]
mov dword [ebp - 0x2054], eax
jmp 0x47b981
mov dword [ebp - 0x380], 0x7e2799ac
mov dword [ebp - 0x388], 0xffffffff
mov dword [ebp - 0x380], 0
jmp 0x47b9e6
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 2
jl 0x47bd16
mov dword [ebp - 0x44c], 0xe8b72fd4
mov dword [ebp - 0x27a0], 0x7e01
mov dword [ebp - 0x279c], 0x7e01
mov dword [ebp - 0x2798], 0x7e01
mov dword [ebp - 0x2794], 0x7e01
lea ecx, [ebp - 0xa8d]
call fcn.00433c76
push eax
lea eax, [ebp - 0x2790]
push eax
lea eax, [ebp - 0x27a0]
push eax
lea ecx, [ebp - 0x3424]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x28b0]
call fcn.00433c25
mov dword [ebp - 0x44c], 0xb
jmp 0x47ba73
mov eax, dword [ebp - 0x44c]
dec eax
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0xffffffe2
jl 0x47bcbe
mov dword [ebp - 0x9dc], 0xffffffff
mov dword [ebp - 0x13a8], 1
push 1
lea ecx, [ebp - 0x25a8]
call fcn.00433b79
mov dword [ebp - 0x2114], 8
mov dword [ebp - 0x58c], 0
jmp 0x47bac4
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 1
jge 0x47bae6
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x25a8]
call fcn.00433c67
mov dword [eax], 0xffff
jmp 0x47bab7
mov eax, dword [ebp - 0x9dc]
add eax, dword [ebp - 0x13a8]
cmp eax, 0x196a
jge 0x47bb18
mov byte [ebp - 0x2a9], 0
movzx eax, byte [ebp - 0x2a9]
test eax, eax
je 0x47bb13
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x47bc95
push 3
lea ecx, [ebp - 0x237c]
call fcn.00433b79
mov dword [ebp - 0x594], 0
jmp 0x47bb3e
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 3
jge 0x47bb60
push dword [ebp - 0x594]
lea ecx, [ebp - 0x237c]
call fcn.00433c67
mov dword [eax], 5
jmp 0x47bb31
mov byte [ebp - 0x339], 0
movzx eax, byte [ebp - 0x339]
test eax, eax
je 0x47bb7f
push 0x151b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0x13a8], 0
jne 0x47bb94
mov eax, dword [ebp - 0x9dc]
sub eax, dword [ebp - 0x380]
push 2
lea ecx, [ebp - 0x237c]
call fcn.00433c67
mov eax, dword [eax]
sub eax, dword [ebp - 0x9dc]
jne 0x47bbbd
cmp dword [ebp - 0x388], 0
jne 0x47bbbd
and dword [ebp - 0x1b38], 0
jmp 0x47bbc7
mov dword [ebp - 0x1b38], 1
mov eax, dword [ebp - 0x1b38]
neg eax
cmp eax, dword [ebp - 0x44c]
jg 0x47bbe3
mov dword [ebp - 0x13b0], 1
jmp 0x47bbea
and dword [ebp - 0x13b0], 0
mov eax, dword [ebp - 0x13b0]
lea esi, [eax*8 - 4]
push 0
lea ecx, [ebp - 0x25a8]
call fcn.00433c67
cmp esi, dword [eax]
jne 0x47bc14
mov dword [ebp - 0x18b8], 1
jmp 0x47bc1b
and dword [ebp - 0x18b8], 0
push 0
lea ecx, [ebp - 0x237c]
call fcn.00433c67
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18b8]
lea eax, [ecx + eax - 9]
test eax, eax
je 0x47bc4d
mov eax, 0xa88a
test eax, eax
je 0x47bc4d
mov dword [ebp - 0x13b8], 1
jmp 0x47bc54
and dword [ebp - 0x13b8], 0
push 2
lea ecx, [ebp - 0x237c]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x13b8]
jge 0x47bc77
mov dword [ebp - 0x1d10], 1
jmp 0x47bc7e
and dword [ebp - 0x1d10], 0
mov eax, dword [ebp - 0x1d10]
mov dword [ebp - 0x2114], eax
lea ecx, [ebp - 0x237c]
call fcn.00433c4b
cmp dword [ebp - 0x380], 0
je 0x47bcae
lea ecx, [ebp - 0x25a8]
call fcn.00433c4b
jmp 0x47ba66
lea ecx, [ebp - 0x25a8]
call fcn.00433c4b
jmp 0x47ba66
mov dword [ebp - 0x388], 3
jmp 0x47bcd7
mov eax, dword [ebp - 0x388]
dec eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
jl 0x47bd06
push 1
lea ecx, [ebp - 0x28b0]
call fcn.00433c67
mov esi, eax
push dword [ebp - 0x388]
lea ecx, [ebp - 0x28b0]
call fcn.00433c67
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x47bcca
lea ecx, [ebp - 0x28b0]
call fcn.00433c4b
jmp 0x47b9d9
mov dword [ebp - 0x390], 1
push 1
lea ecx, [ebp - 0x238c]
call fcn.00433b79
mov dword [ebp - 0x464], 0xda4adcf8
mov dword [ebp - 0x59c], 0
jmp 0x47bd50
mov eax, dword [ebp - 0x59c]
inc eax
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0x59c], 1
jge 0x47bd72
push dword [ebp - 0x59c]
lea ecx, [ebp - 0x238c]
call fcn.00433c67
mov dword [eax], 0xa3df
jmp 0x47bd43
mov dword [ebp - 0x390], 0
jmp 0x47bd8b
mov eax, dword [ebp - 0x390]
dec eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0xfffffff8
jg 0x47c216
mov dword [ebp - 0x18d8], 8
mov dword [ebp - 0x5a4], 0
jmp 0x47bdbb
mov eax, dword [ebp - 0x5a4]
inc eax
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 2
jge 0x47bdd7
mov eax, dword [ebp - 0x5a4]
mov dword [ebp + eax*4 - 0x880], 7
jmp 0x47bdae
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x880], 0
jmp 0x47be05
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x880]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x880], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x880], 0
jl 0x47c211
mov dword [ebp - 0x74], 0x91e29ea4
mov dword [ebp - 0x5ac], 0
jmp 0x47be39
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 1
jge 0x47be55
mov eax, dword [ebp - 0x5ac]
mov dword [ebp + eax*4 - 0xa7c], 0x978d8ef0
jmp 0x47be2c
mov dword [ebp - 0x74], 0
jmp 0x47be65
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x47bff2
mov dword [ebp - 0x45c], 0x874be76d
push dword [ebp - 0x74]
lea ecx, [ebp - 0x238c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47beaa
push 0
lea ecx, [ebp - 0x238c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47beaa
mov dword [ebp - 0x18c0], 1
jmp 0x47beb1
and dword [ebp - 0x18c0], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2e1c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x880]
mov dword [ebp - 0x2a88], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x3248], eax
cmp dword [ebp - 0x74], 0x8e48
jne 0x47beee
mov dword [ebp - 0x13c0], 1
jmp 0x47bef5
and dword [ebp - 0x13c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x880]
cmp dword [ebp - 0x13c0], eax
je 0x47bf16
mov dword [ebp - 0x13c8], 1
jmp 0x47bf1d
and dword [ebp - 0x13c8], 0
mov eax, dword [ebp - 0x18c0]
cmp eax, dword [ebp - 0x13c8]
je 0x47bf37
mov dword [ebp - 0x1b40], 1
jmp 0x47bf3e
and dword [ebp - 0x1b40], 0
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x1b40], eax
jle 0x47bf58
mov dword [ebp - 0x13d0], 1
jmp 0x47bf5f
and dword [ebp - 0x13d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13d0]
mov dword [ebp + eax - 0xa7c], ecx
mov dword [ebp - 0x45c], 0
jmp 0x47bf8b
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
jg 0x47bfed
mov dword [ebp - 0x5b4], 2
cmp dword [ebp - 0x74], 0
je 0x47bfa6
jmp 0x47bfed
mov dword [ebp - 0x5b4], 0
jmp 0x47bfbf
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 0
jg 0x47bfeb
mov byte [ebp - 0x2b1], 0
movzx eax, byte [ebp - 0x2b1]
test eax, eax
je 0x47bfe9
push 0x1f88
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x47bfb2
jmp 0x47bf7e
jmp 0x47be5e
mov dword [ebp - 0x74], 0
jmp 0x47c002
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x47c20c
mov dword [ebp - 0x9e4], 0x56e623b2
mov dword [ebp - 0x1c7c], 0x73ee49ce
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x2a90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa7c]
add eax, dword [ebp - 0x9e4]
cmp eax, 0x2046
jg 0x47c052
mov dword [ebp - 0x18c8], 1
jmp 0x47c059
and dword [ebp - 0x18c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x880]
cmp dword [ebp - 0x18c8], eax
jge 0x47c07a
mov dword [ebp - 0x13d8], 1
jmp 0x47c081
and dword [ebp - 0x13d8], 0
mov eax, dword [ebp - 0x13d8]
mov dword [ebp - 0x1c7c], eax
cmp dword [ebp - 0x1c7c], 0
jae 0x47c0a2
mov dword [ebp - 0x13e0], 1
jmp 0x47c0a9
and dword [ebp - 0x13e0], 0
cmp dword [ebp - 0x13e0], 3
jae 0x47c0be
mov dword [ebp - 0x18d0], 1
jmp 0x47c0c5
and dword [ebp - 0x18d0], 0
cmp dword [ebp - 0x18d0], 0xfffffffa
jne 0x47c0da
mov dword [ebp - 0x13e8], 1
jmp 0x47c0e1
and dword [ebp - 0x13e8], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x13e8], 0x781c
cmp dword [ebp + eax - 0x880], ecx
jge 0x47c108
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x880]
cmp dword [ebp - 0x74], eax
jle 0x47c126
mov dword [ebp - 0x1b48], 1
jmp 0x47c12d
and dword [ebp - 0x1b48], 0
cmp dword [ebp - 0x1b48], 1
ja 0x47c142
mov dword [ebp - 0x13f0], 1
jmp 0x47c149
and dword [ebp - 0x13f0], 0
mov eax, dword [ebp - 0x13f0]
mov dword [ebp - 0x18d8], eax
cmp dword [ebp - 0x18d8], 0x2cdf
je 0x47c16d
mov dword [ebp - 0x13f8], 1
jmp 0x47c174
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0x9e4]
cmp dword [ebp - 0x13f8], eax
jne 0x47c18e
mov dword [ebp - 0x1db0], 1
jmp 0x47c195
and dword [ebp - 0x1db0], 0
cmp dword [ebp - 0x1db0], 0xb5a4
jle 0x47c1ad
mov dword [ebp - 0x205c], 1
jmp 0x47c1b4
and dword [ebp - 0x205c], 0
mov eax, dword [ebp - 0x9e4]
mov dword [ebp - 0x2e2c], eax
mov eax, 0xfe2d5841
cmp eax, 0xffffffff
ja 0x47c1dd
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x47c1dd
mov dword [ebp - 0x1400], 1
jmp 0x47c1e4
and dword [ebp - 0x1400], 0
mov eax, dword [ebp - 0x1400]
mov dword [ebp - 0x464], eax
push 0
lea ecx, [ebp - 0x238c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47c207
jmp 0x47bffb
jmp 0x47bffb
jmp 0x47bdea
jmp 0x47bd7e
mov dword [ebp - 0x464], 0
jmp 0x47c22f
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
jg 0x47c260
mov byte [ebp - 0x33b], 0
movzx eax, byte [ebp - 0x33b]
test eax, eax
je 0x47c25e
push 0x1594
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x47c222
lea ecx, [ebp - 0x238c]
call fcn.00433c4b
mov dword [ebp - 0x3a8], 0x477862fd
mov dword [ebp - 0x1408], 5
mov dword [ebp - 0x5bc], 0
jmp 0x47c298
mov eax, dword [ebp - 0x5bc]
inc eax
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 3
jge 0x47c2b4
mov eax, dword [ebp - 0x5bc]
mov dword [ebp + eax*4 - 0xb40], 8
jmp 0x47c28b
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb40], 6
jmp 0x47c2df
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb40]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb40], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb40], 0xffffffe9
je 0x47c30a
mov byte [ebp - 0x2b9], 0
movzx eax, byte [ebp - 0x2b9]
test eax, eax
je 0x47c308
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47c2c6
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xb40]
cmp dword [ebp + eax - 0xb40], ecx
je 0x47c331
mov dword [ebp - 0x18e0], 1
jmp 0x47c338
and dword [ebp - 0x18e0], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb40], 0xffffffff
jl 0x47c353
mov dword [ebp - 0x1b50], 1
jmp 0x47c35a
and dword [ebp - 0x1b50], 0
mov eax, dword [ebp - 0x18e0]
mov dword [ebp - 0x1408], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xb40]
add ecx, dword [ebp - 0x1408]
imul ecx, dword [ebp + eax - 0xb40]
sub ecx, dword [ebp - 0x1b50]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb40], ecx
push 4
lea ecx, [ebp - 0x294c]
call fcn.00433b79
mov dword [ebp - 0x398], 0x1f2c29a
mov dword [ebp - 0x5cc], 0x38330377
mov dword [ebp - 0x1410], 0
push 2
lea ecx, [ebp - 0x29ac]
call fcn.00433b79
mov dword [ebp - 0x1b58], 4
mov dword [ebp - 0x211c], 0x93cc2542
mov dword [ebp - 0x5c4], 0
jmp 0x47c3fd
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 2
jge 0x47c41c
push dword [ebp - 0x5c4]
lea ecx, [ebp - 0x29ac]
call fcn.00433c67
and dword [eax], 0
jmp 0x47c3f0
cmp dword [ebp - 0x398], 0xfcc58a01
jbe 0x47c43a
mov eax, 0x1dfe
test eax, eax
jne 0x47c43a
and dword [ebp - 0x1420], 0
jmp 0x47c444
mov dword [ebp - 0x1420], 1
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x1410], eax
je 0x47c46a
mov dword [ebp - 0x18e8], 1
jmp 0x47c471
and dword [ebp - 0x18e8], 0
mov eax, dword [ebp - 0x5cc]
cmp dword [ebp - 0x18e8], eax
jl 0x47c48b
mov dword [ebp - 0x1418], 1
jmp 0x47c492
and dword [ebp - 0x1418], 0
mov eax, dword [ebp - 0x5cc]
cmp dword [ebp - 0x1418], eax
jge 0x47c4ac
mov dword [ebp - 0x1c88], 1
jmp 0x47c4b3
and dword [ebp - 0x1c88], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x1c88], eax
jge 0x47c4cd
mov dword [ebp - 0xad8], 1
jmp 0x47c4d4
and dword [ebp - 0xad8], 0
push 0
lea ecx, [ebp - 0x29ac]
call fcn.00433c67
mov ecx, dword [ebp - 0xad8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1420]
add eax, dword [ebp - 0xad8]
cmp eax, dword [ebp - 0x398]
jle 0x47c509
mov dword [ebp - 0x18f0], 1
jmp 0x47c510
and dword [ebp - 0x18f0], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x18f0], eax
je 0x47c533
cmp dword [ebp - 0x5cc], 0
je 0x47c533
mov dword [ebp - 0x1428], 1
jmp 0x47c53a
and dword [ebp - 0x1428], 0
mov eax, dword [ebp - 0x1428]
mov dword [ebp - 0x1b58], eax
mov eax, dword [ebp - 0x1b58]
cmp dword [ebp - 0x398], eax
jge 0x47c560
mov dword [ebp - 0x1430], 1
jmp 0x47c567
and dword [ebp - 0x1430], 0
mov eax, dword [ebp - 0x1430]
mov dword [ebp - 0x211c], eax
mov byte [ebp - 0x33d], 0
movzx eax, byte [ebp - 0x33d]
test eax, eax
je 0x47c595
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea ecx, [ebp - 0x29ac]
call fcn.00433c4b
mov dword [ebp - 0x2074], 0xc9b996a5
mov dword [ebp - 0x5dc], 0x647dc4b
mov dword [ebp - 0x2064], 0xb11f3813
mov dword [ebp - 0x5d4], 0
jmp 0x47c5d7
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 1
jge 0x47c5f3
mov eax, dword [ebp - 0x5d4]
mov dword [ebp + eax*4 - 0x2a98], 0xffffffff
jmp 0x47c5ca
mov byte [ebp - 0x2c1], 0
movzx eax, byte [ebp - 0x2c1]
test eax, eax
je 0x47c61e
push 0xd23
push 0x1117
push 0
push 0
push 0x1ece
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x3124], eax
mov eax, dword [ebp - 0x5dc]
add eax, dword [ebp - 0x5dc]
sub eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x2064], eax
mov dword [ebp - 0x27c8], 1
mov dword [ebp - 0x27c4], 1
mov dword [ebp - 0x27c0], 1
mov dword [ebp - 0x27bc], 1
lea ecx, [ebp - 0xa95]
call fcn.00433c76
push eax
lea eax, [ebp - 0x27b8]
push eax
lea eax, [ebp - 0x27c8]
push eax
lea ecx, [ebp - 0x3434]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2518]
call fcn.00433c25
mov dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x2518]
call fcn.00433c67
and dword [eax], 0
jmp 0x47c6df
push 0
lea ecx, [ebp - 0x2518]
call fcn.00433c67
mov dword [ebp - 0x18f8], eax
mov eax, dword [ebp - 0x18f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18f8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2518]
call fcn.00433c67
cmp dword [eax], 5
jge 0x47c876
mov dword [ebp - 0x5e4], 0x18d58162
mov dword [ebp - 0x5e4], 0
jmp 0x47c718
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 0xe
jg 0x47c871
mov dword [ebp - 0x5ec], 0
jmp 0x47c73e
mov eax, dword [ebp - 0x5ec]
inc eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 1
jge 0x47c75a
mov eax, dword [ebp - 0x5ec]
mov dword [ebp + eax*4 - 0x9ec], 0x85b7f37c
jmp 0x47c731
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9ec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x9ec], eax
mov dword [ebp - 0x5f4], 0
jmp 0x47c78e
mov eax, dword [ebp - 0x5f4]
dec eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 0xffffffe7
jg 0x47c86c
mov dword [ebp - 0x3a0], 0xce2949f4
push 2
lea ecx, [ebp - 0x28c8]
call fcn.00433b79
mov dword [ebp - 0x5fc], 0
jmp 0x47c7cb
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 2
jge 0x47c7ea
push dword [ebp - 0x5fc]
lea ecx, [ebp - 0x28c8]
call fcn.00433c67
and dword [eax], 0
jmp 0x47c7be
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9ec], 0
je 0x47c80f
mov eax, 0xdeb7
test eax, eax
je 0x47c80f
mov dword [ebp - 0x1438], 1
jmp 0x47c816
and dword [ebp - 0x1438], 0
mov eax, dword [ebp - 0x1438]
dec eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a0], 0xfffffff1
jmp 0x47c83c
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 4
jg 0x47c85c
mov esi, dword [ebp - 0x3a0]
push 1
lea ecx, [ebp - 0x28c8]
call fcn.00433c67
mov dword [eax], esi
jmp 0x47c82f
lea ecx, [ebp - 0x28c8]
call fcn.00433c4b
jmp 0x47c781
jmp 0x47c70b
jmp 0x47c6bb
lea ecx, [ebp - 0x2518]
call fcn.00433c4b
mov dword [ebp - 0x604], 0
jmp 0x47c89a
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 4
jge 0x47c8bc
push dword [ebp - 0x604]
lea ecx, [ebp - 0x294c]
call fcn.00433c67
mov dword [eax], 0xac3dc99c
jmp 0x47c88d
mov dword [ebp - 0x20c], 9
push 4
lea ecx, [ebp - 0x1e00]
call fcn.00433b79
mov dword [ebp - 0x2124], 1
mov dword [ebp - 0x60c], 0
jmp 0x47c8f6
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 4
jge 0x47c918
push dword [ebp - 0x60c]
lea ecx, [ebp - 0x1e00]
call fcn.00433c67
mov dword [eax], 1
jmp 0x47c8e9
mov dword [ebp - 0x20c], 5
cmp dword [ebp - 0x20c], 0
je 0x47c951
mov eax, dword [ebp - 0x20c]
add eax, 0x391cb4e7
neg eax
xor ecx, ecx
inc ecx
sub ecx, eax
sub ecx, 0xffff
je 0x47c951
mov dword [ebp - 0x1d18], 1
jmp 0x47c958
and dword [ebp - 0x1d18], 0
cmp dword [ebp - 0x1d18], 0x8b35
jl 0x47c97b
cmp dword [ebp - 0x20c], 0
jne 0x47c97b
xor eax, eax
inc eax
jne 0x47c97b
and dword [ebp - 0x1440], 0
jmp 0x47c985
mov dword [ebp - 0x1440], 1
push 3
lea ecx, [ebp - 0x1e00]
call fcn.00433c67
mov esi, dword [ebp - 0x1440]
imul esi, dword [eax]
push 3
lea ecx, [ebp - 0x1e00]
call fcn.00433c67
cmp esi, dword [eax]
je 0x47c9b8
mov dword [ebp - 0x1900], 1
jmp 0x47c9bf
and dword [ebp - 0x1900], 0
push 0xfffffffffffffffe
pop esi
sub esi, dword [ebp - 0x1900]
push 1
lea ecx, [ebp - 0x1e00]
call fcn.00433c67
mov dword [eax], esi
mov dword [ebp - 0x20c], 0
jmp 0x47c9f0
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffff0
jg 0x47ca25
mov dword [ebp - 0x2124], 0x47941ce3
push 3
lea ecx, [ebp - 0x1e00]
call fcn.00433c67
mov esi, eax
push 3
lea ecx, [ebp - 0x1e00]
call fcn.00433c67
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x47c9e3
lea ecx, [ebp - 0x1e00]
call fcn.00433c4b
mov dword [ebp - 0x3a8], 0
jmp 0x47ca49
mov eax, dword [ebp - 0x3a8]
dec eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0xffffffeb
jle 0x47da85
mov dword [ebp - 0x46c], 0xe2799ac7
mov dword [ebp - 0x1e40], 0x3bf38c08
mov dword [ebp - 0x1e3c], 0x3bf38c08
mov dword [ebp - 0x1e38], 0x3bf38c08
mov dword [ebp - 0x1e34], 0x3bf38c08
mov byte [ebp - 0x33f], 0
movzx eax, byte [ebp - 0x33f]
test eax, eax
je 0x47cab5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 0x46c], 0
jmp 0x47cace
mov eax, dword [ebp - 0x46c]
inc eax
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x46c], 3
jne 0x47ccd6
mov dword [ebp - 0x61c], 8
push 3
lea ecx, [ebp - 0x2620]
call fcn.00433b79
mov dword [ebp - 0x1450], 0xd3ecf04
mov dword [ebp - 0x1910], 0xfbde283b
mov dword [ebp - 0x614], 0
jmp 0x47cb1f
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 3
jge 0x47cb41
push dword [ebp - 0x614]
lea ecx, [ebp - 0x2620]
call fcn.00433c67
mov dword [eax], 0xbb8bffbe
jmp 0x47cb12
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x1448], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1448]
mov dword [ebp + eax - 0x1e40], ecx
cmp dword [ebp - 0x1448], 0
je 0x47cc67
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e40]
mov dword [ebp - 0x2aa0], eax
mov eax, dword [ebp - 0x61c]
cmp dword [ebp - 0x61c], eax
jge 0x47cb9a
mov dword [ebp - 0x1b60], 1
jmp 0x47cba1
and dword [ebp - 0x1b60], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x206c], eax
push 0
lea ecx, [ebp - 0x2620]
call fcn.00433c67
mov ecx, dword [ebp - 0x206c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1b60]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0x1450]
mov dword [ebp - 0x2e3c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1e40], 0
jne 0x47cbf6
mov dword [ebp - 0x1908], 1
jmp 0x47cbfd
and dword [ebp - 0x1908], 0
cmp dword [ebp - 0x1908], 0x6fe5
jl 0x47cc15
mov dword [ebp - 0x1458], 1
jmp 0x47cc1c
and dword [ebp - 0x1458], 0
cmp dword [ebp - 0x1458], 0xfffffff6
jbe 0x47cc31
mov dword [ebp - 0x212c], 1
jmp 0x47cc38
and dword [ebp - 0x212c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e40]
mov dword [ebp - 0x2aa8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e40], 0
je 0x47cc67
mov dword [ebp - 0x1c90], 1
jmp 0x47cc6e
and dword [ebp - 0x1c90], 0
mov eax, dword [ebp - 0x1c90]
sub eax, dword [ebp - 0x61c]
neg eax
jne 0x47cc97
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e40], 0
jne 0x47cc97
and dword [ebp - 0x1460], 0
jmp 0x47cca1
mov dword [ebp - 0x1460], 1
mov eax, dword [ebp - 0x1460]
mov dword [ebp - 0x1910], eax
cmp dword [ebp - 0x1910], 0
je 0x47ccc6
lea ecx, [ebp - 0x2620]
call fcn.00433c4b
jmp 0x47cac1
lea ecx, [ebp - 0x2620]
call fcn.00433c4b
jmp 0x47cac1
mov dword [ebp - 0x1478], 0x67f5ed9a
push 1
lea ecx, [ebp - 0x2874]
call fcn.00433b79
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x624], 0
jmp 0x47cd10
mov eax, dword [ebp - 0x624]
inc eax
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 1
jge 0x47cd32
push dword [ebp - 0x624]
lea ecx, [ebp - 0x2874]
call fcn.00433c67
mov dword [eax], 0x2062
jmp 0x47cd03
mov dword [ebp - 0x2c8], 0
jmp 0x47cd4b
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 1
jge 0x47cd6d
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x2874]
call fcn.00433c67
mov dword [eax], 0xfffffff9
jmp 0x47cd3e
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2c8], eax
lea ecx, [ebp - 0x2874]
call fcn.00433c4b
mov dword [ebp - 0xa84], 1
cmp dword [ebp - 0xa84], 0
je 0x47ce1d
cmp dword [ebp - 0xa84], 0x5c2dd78f
jl 0x47cdb3
mov dword [ebp - 0x1468], 1
jmp 0x47cdba
and dword [ebp - 0x1468], 0
mov eax, dword [ebp - 0x1468]
imul eax, dword [ebp - 0xa84]
mov dword [ebp - 0x1b68], eax
push 3
lea ecx, [ebp - 0x294c]
call fcn.00433c67
mov ecx, dword [ebp - 0x1b68]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3a8]
cmp eax, dword [ebp - 0x1b68]
jg 0x47cdfc
mov dword [ebp - 0x1470], 1
jmp 0x47ce03
and dword [ebp - 0x1470], 0
mov eax, dword [ebp - 0x1478]
cmp dword [ebp - 0x1470], eax
jg 0x47ce1d
mov dword [ebp - 0x1918], 1
jmp 0x47ce24
and dword [ebp - 0x1918], 0
mov eax, dword [ebp - 0x3a8]
imul eax, dword [ebp - 0x1918]
add eax, 0x51c3
cmp dword [ebp - 0x1478], eax
jg 0x47ce4a
mov dword [ebp - 0x1db8], 1
jmp 0x47ce51
and dword [ebp - 0x1db8], 0
imul eax, dword [ebp - 0x1db8], 0xc1df
test eax, eax
jne 0x47ce6d
or eax, 0xffffffff
jne 0x47ce6d
and dword [ebp - 0x1480], 0
jmp 0x47ce77
mov dword [ebp - 0x1480], 1
mov eax, dword [ebp - 0x1480]
mov dword [ebp - 0x2074], eax
mov dword [ebp - 0x3264], 0xcf5720e
mov dword [ebp - 0x2ab0], 0xf94f378
push 2
lea ecx, [ebp - 0x2f78]
call fcn.00433b79
push 4
lea ecx, [ebp - 0x28e0]
call fcn.00433b79
mov dword [ebp - 0x174], 0
jmp 0x47ceca
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x47ceec
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2f78]
call fcn.00433c67
mov dword [eax], 5
jmp 0x47cebd
mov dword [ebp - 0x174], 0
jmp 0x47cf05
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 4
jge 0x47cf27
push dword [ebp - 0x174]
lea ecx, [ebp - 0x28e0]
call fcn.00433c67
mov dword [eax], 0x65425a80
jmp 0x47cef8
mov byte [ebp - 0x2c9], 0
movzx eax, byte [ebp - 0x2c9]
test eax, eax
je 0x47cf4e
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
push 0
lea ecx, [ebp - 0x28e0]
call fcn.00433c67
mov dword [ebp - 0x1920], eax
mov eax, dword [ebp - 0x1920]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1920]
mov dword [ecx], eax
lea ecx, [ebp - 0x28e0]
call fcn.00433c4b
lea ecx, [ebp - 0x2f78]
call fcn.00433c4b
push 1
lea ecx, [ebp - 0x43c]
call fcn.00433b79
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x474], 0x9329bfae
mov dword [ebp - 0x1ec], 0x50ba4309
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x2134], 0
mov dword [ebp - 0x62c], 0
jmp 0x47cfdd
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x62c], 1
jge 0x47cfff
push dword [ebp - 0x62c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov dword [eax], 0x5b57fd54
jmp 0x47cfd0
mov dword [ebp - 0x1c], 0
jmp 0x47d00f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x47d7cc
mov dword [ebp - 0x2d0], 3
mov dword [ebp - 0x2d8], 0xc2b42d22
mov dword [ebp - 0x644], 0xc8e9bdcc
cmp dword [ebp - 0x1c], 1
je 0x47d04b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
push 0
lea ecx, [ebp - 0x43c]
call fcn.00433c67
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x47d088
mov dword [ebp - 0x1488], 1
jmp 0x47d08f
and dword [ebp - 0x1488], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov esi, dword [eax]
sub esi, dword [ebp - 0x1488]
push 0
lea ecx, [ebp - 0x43c]
call fcn.00433c67
imul esi, dword [eax]
test esi, esi
jne 0x47d0c5
mov dword [ebp - 0x1b70], 1
jmp 0x47d0cc
and dword [ebp - 0x1b70], 0
push 0
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov ecx, dword [ebp - 0x1b70]
cmp ecx, dword [eax]
je 0x47d0ef
mov dword [ebp - 0x1490], 1
jmp 0x47d0f6
and dword [ebp - 0x1490], 0
cmp dword [ebp - 0x1490], 0x9dcb7be7
jne 0x47d10e
mov dword [ebp - 0x1928], 1
jmp 0x47d115
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x1928]
sub eax, dword [ebp - 0x474]
cmp eax, 0x214c
jle 0x47d134
mov dword [ebp - 0x1498], 1
jmp 0x47d13b
and dword [ebp - 0x1498], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov ecx, dword [ebp - 0x1498]
add ecx, dword [eax]
je 0x47d162
cmp dword [ebp - 0x1c], 0
je 0x47d162
mov eax, 0x3b947e29
test eax, eax
jne 0x47d17d
push 0
lea ecx, [ebp - 0x43c]
call fcn.00433c67
cmp dword [eax], 0
jne 0x47d17d
and dword [ebp - 0x1c98], 0
jmp 0x47d187
mov dword [ebp - 0x1c98], 1
mov eax, dword [ebp - 0x1c98]
sub eax, dword [ebp - 0x1ec]
je 0x47d1b4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47d1b4
mov dword [ebp - 0x14a0], 1
jmp 0x47d1bb
and dword [ebp - 0x14a0], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x14a0]
jg 0x47d1e6
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x47d1e6
mov dword [ebp - 0x1930], 1
jmp 0x47d1ed
and dword [ebp - 0x1930], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1930]
jg 0x47d211
mov dword [ebp - 0x14a8], 1
jmp 0x47d218
and dword [ebp - 0x14a8], 0
push 0
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov ecx, dword [ebp - 0x14a8]
cmp ecx, dword [eax]
jle 0x47d23b
mov dword [ebp - 0x1b78], 1
jmp 0x47d242
and dword [ebp - 0x1b78], 0
cmp dword [ebp - 0x1b78], 0xbbfefa2e
jae 0x47d25a
mov dword [ebp - 0x14b0], 1
jmp 0x47d261
and dword [ebp - 0x14b0], 0
mov eax, dword [ebp - 0x51c]
add eax, dword [ebp - 0x14b0]
jns 0x47d27b
mov dword [ebp - 0x1938], 1
jmp 0x47d282
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x1938]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xf5f
jge 0x47d2ac
cmp dword [ebp - 0x51c], 0
jne 0x47d2ac
and dword [ebp - 0x14b8], 0
jmp 0x47d2b6
mov dword [ebp - 0x14b8], 1
cmp dword [ebp - 0x14b8], 0xfffffffb
jl 0x47d2de
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47d2de
mov dword [ebp - 0x1d20], 1
jmp 0x47d2e5
and dword [ebp - 0x1d20], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x1d20], eax
jl 0x47d2ff
mov dword [ebp - 0x14c0], 1
jmp 0x47d306
and dword [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x14c0]
mov dword [ebp - 0x2134], eax
mov dword [ebp - 0x474], 0
jmp 0x47d32b
mov eax, dword [ebp - 0x474]
inc eax
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jg 0x47d7c7
push 4
lea ecx, [ebp - 0x1d5c]
call fcn.00433b79
mov dword [ebp - 0x3b0], 0xc72ea128
mov dword [ebp - 0x63c], 0xc6b039b7
mov dword [ebp - 0x634], 0
jmp 0x47d372
mov eax, dword [ebp - 0x634]
inc eax
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 4
jge 0x47d391
push dword [ebp - 0x634]
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
or dword [eax], 0xffffffff
jmp 0x47d365
mov eax, dword [ebp - 0x63c]
inc eax
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x2e4c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2ab8], eax
mov dword [ebp - 0x644], 0
mov esi, dword [ebp - 0x644]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
add esi, dword [eax]
mov edi, dword [ebp - 0x3b0]
push 2
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
mov eax, dword [eax]
lea eax, [edi + eax - 0x5aa71f2d]
cmp esi, eax
jl 0x47d3ff
mov dword [ebp - 0x1940], 1
jmp 0x47d406
and dword [ebp - 0x1940], 0
mov eax, dword [ebp - 0x1940]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
cmp dword [ebp - 0x1c], eax
je 0x47d429
mov dword [ebp - 0x14c8], 1
jmp 0x47d430
and dword [ebp - 0x14c8], 0
imul eax, dword [ebp - 0x14c8], 0xffff
cmp eax, 0x1ab3
je 0x47d44d
mov dword [ebp - 0x1b80], 1
jmp 0x47d454
and dword [ebp - 0x1b80], 0
mov eax, dword [ebp - 0x2d8]
cmp dword [ebp - 0x1b80], eax
jle 0x47d46e
mov dword [ebp - 0x14d0], 1
jmp 0x47d475
and dword [ebp - 0x14d0], 0
push 0
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
mov ecx, dword [ebp - 0x14d0]
add ecx, dword [eax]
je 0x47d734
mov dword [ebp - 0x9f4], 0xffff
mov eax, dword [ebp - 0x63c]
cmp dword [ebp - 0x9f4], eax
jg 0x47d4b4
mov dword [ebp - 0x1948], 1
jmp 0x47d4bb
and dword [ebp - 0x1948], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x1948]
jge 0x47d4e1
mov dword [ebp - 0x1960], 1
jmp 0x47d4e8
and dword [ebp - 0x1960], 0
push 2
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
mov eax, dword [eax]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
jne 0x47d512
mov dword [ebp - 0x14d8], 1
jmp 0x47d519
and dword [ebp - 0x14d8], 0
cmp dword [ebp - 0x14d8], 0x1aff
jge 0x47d531
mov dword [ebp - 0x1ca0], 1
jmp 0x47d538
and dword [ebp - 0x1ca0], 0
mov eax, dword [ebp - 0x1ca0]
sub eax, 0xfff7
jne 0x47d551
mov dword [ebp - 0x14e0], 1
jmp 0x47d558
and dword [ebp - 0x14e0], 0
cmp dword [ebp - 0x14e0], 0xfffffff9
jg 0x47d56d
mov dword [ebp - 0x1950], 1
jmp 0x47d574
and dword [ebp - 0x1950], 0
cmp dword [ebp - 0x1950], 0xffffffff
jne 0x47d589
mov dword [ebp - 0x14e8], 1
jmp 0x47d590
and dword [ebp - 0x14e8], 0
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x14e8], eax
jg 0x47d5b3
cmp dword [ebp - 0x644], 0
je 0x47d5b3
mov dword [ebp - 0x1b88], 1
jmp 0x47d5ba
and dword [ebp - 0x1b88], 0
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0x1b88], eax
jle 0x47d5da
cmp dword [ebp - 0x3b0], 0
jne 0x47d5da
and dword [ebp - 0x14f0], 0
jmp 0x47d5e4
mov dword [ebp - 0x14f0], 1
mov eax, dword [ebp - 0x2d0]
imul eax, dword [ebp - 0x14f0]
test eax, eax
je 0x47d613
push 2
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47d613
mov dword [ebp - 0x1958], 1
jmp 0x47d61a
and dword [ebp - 0x1958], 0
push 0
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
mov ecx, dword [ebp - 0x1958]
cmp ecx, dword [eax]
jle 0x47d63d
mov dword [ebp - 0x14f8], 1
jmp 0x47d644
and dword [ebp - 0x14f8], 0
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x14f8]
jge 0x47d667
push 2
pop eax
test eax, eax
jne 0x47d667
xor eax, eax
inc eax
jne 0x47d667
and dword [ebp - 0x207c], 0
jmp 0x47d671
mov dword [ebp - 0x207c], 1
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x312c], eax
push 2
lea ecx, [ebp - 0x1d5c]
call fcn.00433c67
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x43c]
call fcn.00433c67
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x47d6ac
mov dword [ebp - 0x1dbc], 1
jmp 0x47d6b3
and dword [ebp - 0x1dbc], 0
mov eax, dword [ebp - 0x9f4]
cmp dword [ebp - 0x1dbc], eax
jge 0x47d6cd
mov dword [ebp - 0x1500], 1
jmp 0x47d6d4
and dword [ebp - 0x1500], 0
cmp dword [ebp - 0x1500], 0
je 0x47d6fb
push 0
lea ecx, [ebp - 0x43c]
call fcn.00433c67
cmp dword [eax], 0
je 0x47d6fb
mov dword [ebp - 0x1508], 1
jmp 0x47d702
and dword [ebp - 0x1508], 0
mov eax, dword [ebp - 0x1960]
cmp eax, dword [ebp - 0x1508]
jg 0x47d71c
mov dword [ebp - 0x1b90], 1
jmp 0x47d723
and dword [ebp - 0x1b90], 0
mov eax, dword [ebp - 0x1b90]
mov dword [ebp - 0x1ec], eax
jmp 0x47d7b7
mov dword [ebp - 0x2d0], 0
jmp 0x47d74d
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 0
jg 0x47d7b7
mov dword [ebp - 0x1510], 0xffffffff
mov dword [ebp - 0x2d8], 0
jmp 0x47d779
mov eax, dword [ebp - 0x2d8]
dec eax
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 0
jl 0x47d7b5
mov dword [ebp - 0x1ec], 0
jmp 0x47d79b
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x47d7b3
mov eax, dword [ebp - 0x1510]
inc eax
mov dword [ebp - 0x1510], eax
jmp 0x47d78e
jmp 0x47d76c
jmp 0x47d740
lea ecx, [ebp - 0x1d5c]
call fcn.00433c4b
jmp 0x47d31e
jmp 0x47d008
lea ecx, [ebp - 0x43c]
call fcn.00433c4b
mov byte [ebp - 0x2d1], 0
mov dword [ebp - 0x64c], 0x1928c176
mov byte [ebp - 0x341], 0
movzx eax, byte [ebp - 0x341]
test eax, eax
je 0x47d809
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x64c], 0
jmp 0x47d822
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 2
jg 0x47d842
mov dword [ebp - 0x213c], 0xc3099cfe
cmp dword [ebp - 0x213c], 0
je 0x47d840
jmp 0x47d842
jmp 0x47d815
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x47da80
mov dword [ebp - 0x204], 0x6915a136
mov dword [ebp - 0x2084], 1
mov dword [ebp - 0x2144], 0x1b98
push 2
lea ecx, [ebp - 0x2530]
call fcn.00433b79
push 1
lea ecx, [ebp - 0x2994]
call fcn.00433b79
mov dword [ebp - 0xfc], 0
jmp 0x47d8a2
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x47d8c4
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x2530]
call fcn.00433c67
mov dword [eax], 0x31fadacd
jmp 0x47d895
mov dword [ebp - 0xfc], 0
jmp 0x47d8dd
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x47d8ff
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x2994]
call fcn.00433c67
mov dword [eax], 0xdc1b6eab
jmp 0x47d8d0
cmp dword [ebp - 0x204], 0
jne 0x47d957
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x2ac0], eax
mov eax, dword [ebp - 0x204]
neg eax
cmp eax, dword [ebp - 0x2084]
jge 0x47d936
cmp dword [ebp - 0x2144], 0
jne 0x47d936
and dword [ebp - 0x1968], 0
jmp 0x47d940
mov dword [ebp - 0x1968], 1
mov eax, dword [ebp - 0x204]
sub eax, dword [ebp - 0x1968]
jne 0x47d957
and dword [ebp - 0x1518], 0
jmp 0x47d961
mov dword [ebp - 0x1518], 1
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x1518]
je 0x47d97b
mov dword [ebp - 0x1ca8], 1
jmp 0x47d982
and dword [ebp - 0x1ca8], 0
cmp dword [ebp - 0x1ca8], 0x6eea5306
jne 0x47d99a
mov dword [ebp - 0x1520], 1
jmp 0x47d9a1
and dword [ebp - 0x1520], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x1520], eax
jl 0x47d9bb
mov dword [ebp - 0x1970], 1
jmp 0x47d9c2
and dword [ebp - 0x1970], 0
cmp dword [ebp - 0x1970], 7
je 0x47d9d7
mov dword [ebp - 0x1528], 1
jmp 0x47d9de
and dword [ebp - 0x1528], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x1528]
jge 0x47d9f8
mov dword [ebp - 0x1b98], 1
jmp 0x47d9ff
and dword [ebp - 0x1b98], 0
push 1
lea ecx, [ebp - 0x2530]
call fcn.00433c67
mov ecx, dword [ebp - 0x1b98]
mov dword [eax], ecx
cmp dword [ebp - 0x204], 0xb445
je 0x47da2c
mov dword [ebp - 0xb30], 1
jmp 0x47da33
and dword [ebp - 0xb30], 0
push 0
lea ecx, [ebp - 0x2530]
call fcn.00433c67
mov ecx, dword [ebp - 0xb30]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x2994]
call fcn.00433c67
mov ecx, dword [ebp - 0xb30]
mov dword [eax], ecx
lea ecx, [ebp - 0x2994]
call fcn.00433c4b
lea ecx, [ebp - 0x2530]
call fcn.00433c4b
push 0x1166
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x47ca3c
lea ecx, [ebp - 0x294c]
call fcn.00433c4b
call fcn.0046c4ab
mov dword [ebp - 0x9fc], 0x12b57e8b
mov dword [ebp - 0x47c], 0x196a162c
mov dword [ebp - 0x484], 0x101aae4b
mov dword [ebp - 0x214c], 0x11b55e9
mov dword [ebp - 0x2094], 0xba09a164
mov dword [ebp - 0x2154], 0x989265
cmp dword [ebp - 0x47c], 0
je 0x47dbc9
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x47c], eax
imul eax, dword [ebp - 0x47c], 0
cmp eax, dword [ebp - 0x47c]
jl 0x47db0b
cmp dword [ebp - 0x47c], 0
jne 0x47db0b
and dword [ebp - 0x1530], 0
jmp 0x47db15
mov dword [ebp - 0x1530], 1
cmp dword [ebp - 0x1530], 3
jge 0x47db2a
mov dword [ebp - 0x1978], 1
jmp 0x47db31
and dword [ebp - 0x1978], 0
imul eax, dword [ebp - 0x1978], 0x72dd
cmp eax, dword [ebp - 0x484]
je 0x47db4f
mov dword [ebp - 0x208c], 1
jmp 0x47db56
and dword [ebp - 0x208c], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x2e5c], eax
mov eax, 0xbfe7374
cmp eax, 0xffffffff
jbe 0x47db78
mov dword [ebp - 0x1538], 1
jmp 0x47db7f
and dword [ebp - 0x1538], 0
mov eax, dword [ebp - 0x484]
imul eax, dword [ebp - 0x1538]
test eax, eax
jne 0x47dba2
cmp dword [ebp - 0x214c], 0
jne 0x47dba2
and dword [ebp - 0x1d30], 0
jmp 0x47dbac
mov dword [ebp - 0x1d30], 1
mov eax, dword [ebp - 0x484]
add eax, dword [ebp - 0x1d30]
cmp eax, 0xfffffff7
jne 0x47dbc9
mov dword [ebp - 0x1540], 1
jmp 0x47dbd0
and dword [ebp - 0x1540], 0
mov eax, dword [ebp - 0x2094]
cmp dword [ebp - 0x1540], eax
jl 0x47dbea
mov dword [ebp - 0x1980], 1
jmp 0x47dbf1
and dword [ebp - 0x1980], 0
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x9fc]
cmp eax, dword [ebp - 0x1980]
jg 0x47dc17
mov dword [ebp - 0x1548], 1
jmp 0x47dc1e
and dword [ebp - 0x1548], 0
mov eax, dword [ebp - 0x1548]
mov dword [ebp - 0x2154], eax
mov byte [ebp - 0x343], 0
movzx eax, byte [ebp - 0x343]
test eax, eax
je 0x47dc64
push 0xde3
push 0x8b
push 0x1e0d
push 0xb3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov dword [ebp - 0x94], 0xffffffff
push 2
lea ecx, [ebp - 0x8c4]
call fcn.00433b79
push 1
lea ecx, [ebp - 0x1d6c]
call fcn.00433b79
mov dword [ebp - 0x1c4], 0xfffffff7
mov dword [ebp - 0x2ac8], 0xfffffffb
mov dword [ebp - 0x1580], 0xfffffffa
mov dword [ebp - 0x215c], 1
mov dword [ebp - 0xa8c], 0xfffffffd
mov dword [ebp - 0x20a8], 0xfffffff6
mov dword [ebp - 0x17c], 0
jmp 0x47dcdd
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x47dcff
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov dword [eax], 0xfffffff8
jmp 0x47dcd0
mov dword [ebp - 0x17c], 0
jmp 0x47dd18
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x47dd3a
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov dword [eax], 0xd3b0cf5a
jmp 0x47dd0b
cmp dword [ebp - 0x94], 0
je 0x47dd4f
mov dword [ebp - 0x1558], 1
jmp 0x47dd56
and dword [ebp - 0x1558], 0
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
cmp dword [eax], 0x816f93bd
ja 0x47dd77
mov dword [ebp - 0x19b0], 1
jmp 0x47dd7e
and dword [ebp - 0x19b0], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x19b0]
cmp eax, 0xdc41
jle 0x47dd9d
mov dword [ebp - 0x1550], 1
jmp 0x47dda4
and dword [ebp - 0x1550], 0
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov ecx, dword [ebp - 0x1550]
cmp ecx, dword [eax]
jg 0x47ddc7
mov dword [ebp - 0x1988], 1
jmp 0x47ddce
and dword [ebp - 0x1988], 0
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov ecx, dword [ebp - 0x1988]
imul ecx, dword [eax]
mov dword [ebp - 0x19b4], ecx
push 0
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov ecx, dword [ebp - 0x19b4]
mov dword [eax], ecx
mov esi, dword [ebp - 0x94]
add esi, dword [ebp - 0x1558]
add esi, dword [ebp - 0x19b4]
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
imul esi, dword [eax]
test esi, esi
je 0x47de3a
mov eax, 0x8d06
test eax, eax
je 0x47de3a
mov dword [ebp - 0x1560], 1
jmp 0x47de41
and dword [ebp - 0x1560], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1560], eax
jg 0x47de5b
mov dword [ebp - 0x1990], 1
jmp 0x47de62
and dword [ebp - 0x1990], 0
cmp dword [ebp - 0x1990], 0x3dec995f
jge 0x47de7a
mov dword [ebp - 0x1568], 1
jmp 0x47de81
and dword [ebp - 0x1568], 0
mov eax, dword [ebp - 0x1568]
mov dword [ebp - 0x1c4], eax
push 0
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov esi, eax
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov esi, dword [esi]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
cmp esi, dword [eax]
jg 0x47ded4
cmp dword [ebp - 0x1c4], 0
je 0x47ded4
mov dword [ebp - 0x19bc], 1
jmp 0x47dedb
and dword [ebp - 0x19bc], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x19bc], eax
jg 0x47def5
mov dword [ebp - 0x1570], 1
jmp 0x47defc
and dword [ebp - 0x1570], 0
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov ecx, dword [ebp - 0x1570]
cmp ecx, dword [eax]
jg 0x47df1f
mov dword [ebp - 0x209c], 1
jmp 0x47df26
and dword [ebp - 0x209c], 0
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
cmp dword [ebp - 0x1c4], 0
je 0x47e031
mov byte [ebp - 0x2d9], 0
movzx eax, byte [ebp - 0x2d9]
test eax, eax
je 0x47df58
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x94], 1
jmp 0x47df71
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x47e02f
mov dword [ebp - 0x1c4], 0
jmp 0x47df97
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jg 0x47e00e
mov dword [ebp - 0x48c], 0xffffffff
mov dword [ebp - 0x48c], 0
jmp 0x47dfc3
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 1
jge 0x47dfe5
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov dword [eax], 0x807c1abd
jmp 0x47dfb6
mov byte [ebp - 0x345], 0
movzx eax, byte [ebp - 0x345]
test eax, eax
je 0x47e009
push 0x851
push 0xaca
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x47df8a
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x47e02a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x47df64
jmp 0x47e04e
mov byte [ebp - 0x347], 0
movzx eax, byte [ebp - 0x347]
test eax, eax
je 0x47e04e
push 0x2415
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
cmp dword [ebp - 0x1c4], 0
jne 0x47e097
cmp dword [ebp - 0x215c], 4
je 0x47e082
cmp dword [ebp - 0x1c4], 0
je 0x47e082
mov dword [ebp - 0x1998], 1
jmp 0x47e089
and dword [ebp - 0x1998], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1998], eax
jge 0x47e0ac
mov eax, 0x8161dbfa
test eax, eax
je 0x47e0ac
mov dword [ebp - 0x1578], 1
jmp 0x47e0b3
and dword [ebp - 0x1578], 0
mov eax, dword [ebp - 0x20a8]
cmp dword [ebp - 0x1578], eax
jl 0x47e0cd
mov dword [ebp - 0x19c4], 1
jmp 0x47e0d4
and dword [ebp - 0x19c4], 0
push 0
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov ecx, dword [ebp - 0x19c4]
imul ecx, dword [eax]
mov dword [ebp - 0x1580], ecx
cmp dword [ebp - 0x1580], 0
je 0x47e10e
mov eax, 0x1ea52fa5
test eax, eax
je 0x47e10e
mov dword [ebp - 0x20dc], 1
jmp 0x47e115
and dword [ebp - 0x20dc], 0
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x325c], eax
mov eax, dword [ebp - 0xa8c]
dec eax
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0x94], 0xfffffffa
jge 0x47e143
mov dword [ebp - 0x20b4], 1
jmp 0x47e14a
and dword [ebp - 0x20b4], 0
push 0
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov esi, dword [ebp - 0x94]
push 1
lea ecx, [ebp - 0x8c4]
call fcn.00433c67
mov edi, eax
push 0
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov ecx, dword [edi]
add ecx, dword [eax]
cmp esi, ecx
jle 0x47e196
mov eax, 0x2ffa
test eax, eax
je 0x47e196
mov dword [ebp - 0x19a0], 1
jmp 0x47e19d
and dword [ebp - 0x19a0], 0
push 0
lea ecx, [ebp - 0x1d6c]
call fcn.00433c67
mov ecx, dword [ebp - 0x19a0]
mov dword [eax], ecx
lea ecx, [ebp - 0x1d6c]
call fcn.00433c4b
lea ecx, [ebp - 0x8c4]
call fcn.00433c4b
push 1
lea ecx, [ebp - 0xb64]
call fcn.00433b79
mov dword [ebp - 0x28], 0xb0b02971
push 1
lea ecx, [ebp - 0x29c4]
call fcn.00433b79
mov dword [ebp - 0x1c0], 0
jmp 0x47e202
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x47e224
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
mov dword [eax], 0xe91a
jmp 0x47e1f5
mov dword [ebp - 0x1c0], 0
jmp 0x47e23d
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x47e25f
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x29c4]
call fcn.00433c67
mov dword [eax], 0x7f4a7d2a
jmp 0x47e230
mov dword [ebp - 0x28], 0
jmp 0x47e26f
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x47e424
mov dword [ebp - 0x216c], 0xfffffff8
mov dword [ebp - 0x2174], 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jne 0x47e2ae
mov dword [ebp - 0xd88], 1
jmp 0x47e2b5
and dword [ebp - 0xd88], 0
push 0
lea ecx, [ebp - 0xb64]
call fcn.00433c67
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x47e2f2
mov dword [ebp - 0x1588], 1
jmp 0x47e2f9
and dword [ebp - 0x1588], 0
cmp dword [ebp - 0x1588], 0xb058efa9
jbe 0x47e324
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
cmp dword [eax], 0
je 0x47e324
mov dword [ebp - 0x19cc], 1
jmp 0x47e32b
and dword [ebp - 0x19cc], 0
cmp dword [ebp - 0x19cc], 0x80c6
je 0x47e343
mov dword [ebp - 0x1590], 1
jmp 0x47e34a
and dword [ebp - 0x1590], 0
cmp dword [ebp - 0x1590], 0x56411d7f
jge 0x47e362
mov dword [ebp - 0x19a8], 1
jmp 0x47e369
and dword [ebp - 0x19a8], 0
mov eax, dword [ebp - 0x216c]
cmp dword [ebp - 0x19a8], eax
je 0x47e383
mov dword [ebp - 0x1598], 1
jmp 0x47e38a
and dword [ebp - 0x1598], 0
cmp dword [ebp - 0x1598], 0xef5d
jge 0x47e3a2
mov dword [ebp - 0x19d4], 1
jmp 0x47e3a9
and dword [ebp - 0x19d4], 0
imul eax, dword [ebp - 0x19d4], 0x732a
mov dword [ebp - 0x15a0], eax
push 0
lea ecx, [ebp - 0x29c4]
call fcn.00433c67
mov ecx, dword [ebp - 0x15a0]
mov dword [eax], ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
mov ecx, dword [ebp - 0x15a0]
imul ecx, dword [eax]
cmp dword [ebp - 0xd88], ecx
jne 0x47e3f9
mov dword [ebp - 0x20c0], 1
jmp 0x47e400
and dword [ebp - 0x20c0], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0xb64]
call fcn.00433c67
mov eax, 0xfff9
imul eax, eax, 0xffff
mov dword [ebp - 0x2174], eax
jmp 0x47e268
mov dword [ebp - 0x28], 8
jmp 0x47e434
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff2
jl 0x47e45d
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x47e45b
push 0x211b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x47e42d
lea ecx, [ebp - 0x29c4]
call fcn.00433c4b
lea ecx, [ebp - 0xb64]
call fcn.00433c4b
mov dword [ebp - 0x950], 0xfffffffe
push 1
lea ecx, [ebp - 0xaf4]
call fcn.00433b79
mov dword [ebp - 0x217c], 0x1eca6c84
mov dword [ebp - 0x20d8], 0
mov dword [ebp - 0x68], 0
jmp 0x47e4ae
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x47e4c4
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x24dc], 1
jmp 0x47e4a7
mov dword [ebp - 0x68], 0
jmp 0x47e4d4
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x47e4f0
push dword [ebp - 0x68]
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov dword [eax], 0x6fe7d8a8
jmp 0x47e4cd
mov dword [ebp - 0x68], 0
jmp 0x47e500
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x47e516
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x2ad0], 0xffffffff
jmp 0x47e4f9
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov dword [eax], 3
jmp 0x47e54f
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xd8c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd8c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
cmp dword [eax], 0
jl 0x47e6c5
mov dword [ebp - 0xa04], 0xa0d018d3
mov dword [ebp - 0xd84], 0x83a0f0f5
mov byte [ebp - 0x349], 0
movzx eax, byte [ebp - 0x349]
test eax, eax
je 0x47e59c
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x24dc], 0xffffffff
jb 0x47e6ad
cmp dword [ebp - 0xa04], 0xffffffff
je 0x47e5ce
mov dword [ebp - 0x20cc], 1
jmp 0x47e5d5
and dword [ebp - 0x20cc], 0
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24dc]
mov dword [ebp - 0x2e6c], eax
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24dc]
mov dword [ebp - 0x217c], eax
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24dc]
mov dword [ebp - 0xd84], eax
mov esi, dword [ebp - 0xa04]
imul edi, dword [ebp - 0xd84], 0xe1f6
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24dc]
imul eax, edi
cmp eax, esi
jge 0x47e662
mov dword [ebp - 0xd9c], 1
jmp 0x47e669
and dword [ebp - 0xd9c], 0
mov eax, dword [ebp - 0xd9c]
imul eax, dword [ebp - 0xa04]
mov dword [ebp - 0xda4], eax
push 0
lea ecx, [ebp - 0xaf4]
call fcn.00433c67
mov eax, dword [eax]
mov ecx, dword [ebp - 0xda4]
mov dword [ebp + eax*4 - 0x24dc], ecx
cmp dword [ebp - 0xda4], 0
je 0x47e6ad
mov dword [ebp - 0xdac], 1
jmp 0x47e6b4
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0x20d8], eax
jmp 0x47e52b
lea ecx, [ebp - 0xaf4]
call fcn.00433c4b
mov dword [ebp - 0x1f8], 0xade2167f
mov dword [ebp - 0xb0], 0x68ec0ae9
mov dword [ebp - 0xdb4], 0xffffffff
mov dword [ebp - 0x2184], 0
mov dword [ebp - 0xb0], 0
jmp 0x47e711
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffef
jle 0x47e853
mov dword [ebp - 0xae8], 0xc7a0
mov dword [ebp - 0xdd4], 0xffffffff
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0xdd4], eax
mov eax, 0x61ec
cmp eax, 1
jge 0x47e769
mov eax, 0xa017
test eax, eax
je 0x47e769
mov dword [ebp - 0xdbc], 1
jmp 0x47e770
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xdbc]
sub eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0xb0]
jg 0x47e797
mov dword [ebp - 0xdc4], 1
jmp 0x47e79e
and dword [ebp - 0xdc4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xdc4], eax
jne 0x47e7b8
mov dword [ebp - 0xdcc], 1
jmp 0x47e7bf
and dword [ebp - 0xdcc], 0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xdcc]
sub ecx, dword [ebp - 0xb0]
sub eax, ecx
mov ecx, dword [ebp - 0xb0]
lea eax, [eax + ecx + 0x629c4ddb]
test eax, eax
je 0x47e7f9
cmp dword [ebp - 0xdd4], 0
je 0x47e7f9
mov dword [ebp - 0xddc], 1
jmp 0x47e800
and dword [ebp - 0xddc], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xddc], eax
jle 0x47e81a
mov dword [ebp - 0xb74], 1
jmp 0x47e821
and dword [ebp - 0xb74], 0
mov eax, dword [ebp - 0xae8]
cmp eax, dword [ebp - 0xb74]
jg 0x47e83b
mov dword [ebp - 0xdec], 1
jmp 0x47e842
and dword [ebp - 0xdec], 0
mov eax, dword [ebp - 0xdec]
mov dword [ebp - 0x2184], eax
jmp 0x47e704
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x47e86b
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [ebp - 0x2ad8], 0xef9f3b06
push 3
lea ecx, [ebp - 0x2f88]
call fcn.00433b79
push 3
lea ecx, [ebp - 0x239c]
call fcn.00433b79
mov dword [ebp - 0x188], 0
jmp 0x47e8a8
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x47e8ca
push dword [ebp - 0x188]
lea ecx, [ebp - 0x2f88]
call fcn.00433c67
mov dword [eax], 0x3342eb90
jmp 0x47e89b
mov dword [ebp - 0x188], 0
jmp 0x47e8e3
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x47e902
push dword [ebp - 0x188]
lea ecx, [ebp - 0x239c]
call fcn.00433c67
and dword [eax], 0
jmp 0x47e8d6
mov byte [ebp - 0x34b], 0
movzx eax, byte [ebp - 0x34b]
test eax, eax
je 0x47e91c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
push 0
lea ecx, [ebp - 0x239c]
call fcn.00433c67
and dword [eax], 0
jmp 0x47e952
push 0
lea ecx, [ebp - 0x239c]
call fcn.00433c67
mov dword [ebp - 0xdf4], eax
mov eax, dword [ebp - 0xdf4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdf4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x239c]
call fcn.00433c67
cmp dword [eax], 2
jg 0x47e9a1
mov byte [ebp - 0x2f9], 0
movzx eax, byte [ebp - 0x2f9]
test eax, eax
je 0x47e985
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 0x34d], 0
movzx eax, byte [ebp - 0x34d]
test eax, eax
je 0x47e99f
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
jmp 0x47e92e
lea ecx, [ebp - 0x239c]
call fcn.00433c4b
lea ecx, [ebp - 0x2f88]
call fcn.00433c4b
mov eax, dword [ebp - 0x950]
cmp dword [ebp - 0x950], eax
je 0x47e9d1
mov dword [ebp - 0xdfc], 1
jmp 0x47e9d8
and dword [ebp - 0xdfc], 0
mov eax, dword [ebp - 0xdfc]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
je 0x4822d0
mov dword [ebp - 0x958], 0xffffffff
mov dword [ebp - 0x1a8], 0x4e2db58
mov dword [ebp - 0x494], 0xfffffffd
mov dword [ebp - 0x218c], 0xffffffff
push 1
lea ecx, [ebp - 0x2f98]
call fcn.00433b79
mov dword [ebp - 0x654], 0
jmp 0x47ea4b
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 1
jge 0x47ea6d
push dword [ebp - 0x654]
lea ecx, [ebp - 0x2f98]
call fcn.00433c67
mov dword [eax], 0xfffffff7
jmp 0x47ea3e
mov dword [ebp - 0x1a8], 0xa
jmp 0x47ea86
mov eax, dword [ebp - 0x1a8]
dec eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 8
jg 0x47eb30
push 2
lea ecx, [ebp - 0x291c]
call fcn.00433b79
mov dword [ebp - 0x65c], 0
jmp 0x47eab9
mov eax, dword [ebp - 0x65c]
inc eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 2
jge 0x47eadb
push dword [ebp - 0x65c]
lea ecx, [ebp - 0x291c]
call fcn.00433c67
mov dword [eax], 0xc3a0b8ee
jmp 0x47eaac
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x494], 0
jmp 0x47eb00
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0x13
jg 0x47eb20
push 0
lea ecx, [ebp - 0x291c]
call fcn.00433c67
mov eax, dword [eax]
mov dword [ebp - 0x218c], eax
jmp 0x47eaf3
lea ecx, [ebp - 0x291c]
call fcn.00433c4b
jmp 0x47ea79
mov dword [ebp - 0x1a8], 0
jmp 0x47eb49
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jg 0x47eb6e
mov byte [ebp - 0x301], 0
movzx eax, byte [ebp - 0x301]
test eax, eax
je 0x47eb6c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x47eb3c
lea ecx, [ebp - 0x2f98]
call fcn.00433c4b
mov dword [ebp - 0x3134], 0
push 1
lea ecx, [ebp - 0x430]
call fcn.00433b79
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x49c], 0x9329bfae
mov dword [ebp - 0x1cc], 0x50ba4309
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x2164], 0
mov dword [ebp - 0x664], 0
jmp 0x47ebd8
mov eax, dword [ebp - 0x664]
inc eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 1
jge 0x47ebfa
push dword [ebp - 0x664]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov dword [eax], 0x5b57fd54
jmp 0x47ebcb
mov dword [ebp - 0x10], 0
jmp 0x47ec0a
cmp dword [ebp - 0x10], 0
jg 0x47f3c7
mov dword [ebp - 0x2e0], 3
mov dword [ebp - 0x2e8], 0xc2b42d22
mov dword [ebp - 0x67c], 0xc8e9bdcc
cmp dword [ebp - 0x10], 1
je 0x47ec46
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
push 0
lea ecx, [ebp - 0x430]
call fcn.00433c67
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x47ec83
mov dword [ebp - 0xe04], 1
jmp 0x47ec8a
and dword [ebp - 0xe04], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov esi, dword [eax]
sub esi, dword [ebp - 0xe04]
push 0
lea ecx, [ebp - 0x430]
call fcn.00433c67
imul esi, dword [eax]
test esi, esi
jne 0x47ecc0
mov dword [ebp - 0xe0c], 1
jmp 0x47ecc7
and dword [ebp - 0xe0c], 0
push 0
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov ecx, dword [ebp - 0xe0c]
cmp ecx, dword [eax]
je 0x47ecea
mov dword [ebp - 0xe14], 1
jmp 0x47ecf1
and dword [ebp - 0xe14], 0
cmp dword [ebp - 0xe14], 0x9dcb7be7
jne 0x47ed09
mov dword [ebp - 0xe1c], 1
jmp 0x47ed10
and dword [ebp - 0xe1c], 0
mov eax, dword [ebp - 0xe1c]
sub eax, dword [ebp - 0x49c]
cmp eax, 0x214c
jle 0x47ed2f
mov dword [ebp - 0xe24], 1
jmp 0x47ed36
and dword [ebp - 0xe24], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov ecx, dword [ebp - 0xe24]
add ecx, dword [eax]
je 0x47ed5d
cmp dword [ebp - 0x10], 0
je 0x47ed5d
mov eax, 0x3b947e29
test eax, eax
jne 0x47ed78
push 0
lea ecx, [ebp - 0x430]
call fcn.00433c67
cmp dword [eax], 0
jne 0x47ed78
and dword [ebp - 0xe2c], 0
jmp 0x47ed82
mov dword [ebp - 0xe2c], 1
mov eax, dword [ebp - 0xe2c]
sub eax, dword [ebp - 0x1cc]
je 0x47edaf
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
cmp dword [eax], 0
je 0x47edaf
mov dword [ebp - 0xe34], 1
jmp 0x47edb6
and dword [ebp - 0xe34], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe34]
jg 0x47ede1
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x47ede1
mov dword [ebp - 0xe3c], 1
jmp 0x47ede8
and dword [ebp - 0xe3c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe3c]
jg 0x47ee0c
mov dword [ebp - 0xe44], 1
jmp 0x47ee13
and dword [ebp - 0xe44], 0
push 0
lea ecx, [ebp - 0x430]
call fcn.00433c67
mov ecx, dword [ebp - 0xe44]
cmp ecx, dword [eax]
jle 0x47ee36
mov dword [ebp - 0xe4c], 1
jmp 0x47ee3d
and dword [ebp - 0xe4c], 0
cmp dword [ebp - 0xe4c], 0xbbfefa2e
jae 0x47ee55
mov dword [ebp - 0xe54], 1
jmp 0x47ee5c
and dword [ebp - 0xe54], 0
mov eax, dword [ebp - 0x684]
add eax, dword [ebp - 0xe54]
jns 0x47ee76
mov dword [ebp - 0xe5c], 1
jmp 0x47ee7d
and dword [ebp - 0xe5c], 0
mov eax, dword [ebp - 0xe5c]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xf5f
jge 0x47eea7
cmp dword [ebp - 0x684], 0
jne 0x47eea7
and dword [ebp - 0xe64], 0
jmp 0x47eeb1
mov dword [ebp - 0xe64], 1
cmp dword [ebp - 0xe64], 0xfffffffb
jl 0x47eed9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x430]
call fcn.00433c67
cmp dword [eax], 0
je 0x47eed9
mov dword [ebp - 0xe6c], 1
jmp 0x47eee0
and dword [ebp - 0xe6c], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0xe6c], eax
jl 0x47eefa
mov dword [ebp - 0xe74], 1
jmp 0x47ef01
and dword [ebp - 0xe74], 0
mov eax, dword [ebp - 0xe74]
mov dword [ebp - 0x2164], eax
mov dword [ebp - 0x49c], 0
jmp 0x47ef26
cmp dword [ebp - 0x49c], 0
jg 0x47f3c2
lea ecx, [ebp - 0x430]
call fcn.00433c4b
mov dword [ebp - 0x326c], 0x205300ce
mov dword [ebp - 0x2af0], 1
mov byte [ebp - 0x34f], 0
movzx eax, byte [ebp - 0x34f]
test eax, eax
je 0x47f403
push 0xfa1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x21a], 0
movzx eax, byte [ebp - 0x21a]
test eax, eax
je 0x47f42c
push 0x1770
push 0
push 0x24e3
push 0x3b7
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x2e8c], 0xfffffff8
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0xc8], 0xfffffff6
mov dword [ebp - 0x900], 0
mov dword [ebp - 0xf6c], 0xfffffff8
mov dword [ebp - 0x68c], 0
jmp 0x47f477
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 3
jge 0x47f493
mov eax, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x33ac], 0xe77da19
jmp 0x47f46a
mov byte [ebp - 0x21b], 0
movzx eax, byte [ebp - 0x21b]
test eax, eax
je 0x47f4ad
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x2af8], eax
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], eax
jl 0x47f4d3
mov dword [ebp - 0xf1c], 1
jmp 0x47f4da
and dword [ebp - 0xf1c], 0
cmp dword [ebp - 0xf1c], 0
jb 0x47f4ef
mov dword [ebp - 0xf24], 1
jmp 0x47f4f6
and dword [ebp - 0xf24], 0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0xf24]
add ecx, 0x49f4
imul eax, ecx
cmp eax, 1
jl 0x47f520
xor eax, eax
je 0x47f520
mov dword [ebp - 0x2370], 1
jmp 0x47f527
and dword [ebp - 0x2370], 0
or eax, 0xffffffff
je 0x47f7da
mov dword [ebp - 0xf3c], 0
push 3
lea ecx, [ebp - 0x1e18]
call fcn.00433b79
mov dword [ebp - 0x694], 0
jmp 0x47f560
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 3
jge 0x47f57f
push dword [ebp - 0x694]
lea ecx, [ebp - 0x1e18]
call fcn.00433c67
or dword [eax], 0xffffffff
jmp 0x47f553
mov byte [ebp - 0x21d], 0
movzx eax, byte [ebp - 0x21d]
test eax, eax
je 0x47f5a3
push 0xc37
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp - 0xe8], 0
jne 0x47f78a
mov eax, dword [ebp - 0x900]
inc eax
mov dword [ebp - 0x900], eax
mov eax, 0xeaa473ec
test eax, eax
jae 0x47f5d2
mov dword [ebp - 0x20f0], 1
jmp 0x47f5d9
and dword [ebp - 0x20f0], 0
mov eax, dword [ebp - 0xf3c]
mov dword [ebp - 0x313c], eax
cmp dword [ebp - 0x900], 0
je 0x47f5ff
xor eax, eax
inc eax
je 0x47f5ff
mov dword [ebp - 0xf2c], 1
jmp 0x47f606
and dword [ebp - 0xf2c], 0
push 2
lea ecx, [ebp - 0x1e18]
call fcn.00433c67
mov ecx, dword [ebp - 0xf2c]
cmp ecx, dword [eax]
jge 0x47f629
mov dword [ebp - 0xf34], 1
jmp 0x47f630
and dword [ebp - 0xf34], 0
cmp dword [ebp - 0xf34], 0xffffffff
jle 0x47f645
mov dword [ebp - 0xf44], 1
jmp 0x47f64c
and dword [ebp - 0xf44], 0
mov eax, dword [ebp - 0xf3c]
cmp dword [ebp - 0xf44], eax
jne 0x47f666
mov dword [ebp - 0xf4c], 1
jmp 0x47f66d
and dword [ebp - 0xf4c], 0
cmp dword [ebp - 0xf4c], 0xb88cdf8a
jbe 0x47f685
mov dword [ebp - 0xf8c], 1
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xf8c]
je 0x47f7ae
mov dword [ebp - 0xf94], 1
jmp 0x47f7b5
and dword [ebp - 0xf94], 0
push 1
lea ecx, [ebp - 0x1e18]
call fcn.00433c67
mov ecx, dword [ebp - 0xf94]
mov dword [eax], ecx
lea ecx, [ebp - 0x1e18]
call fcn.00433c4b
jmp 0x47f87e
mov dword [ebp - 0xc8], 0
jmp 0x47f7f3
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfffffffe
jg 0x47f849
mov byte [ebp - 0x21f], 0
movzx eax, byte [ebp - 0x21f]
test eax, eax
je 0x47f82a
push 0
push 0x1aa6
push 0x1d08
push 0x1a80
push 0xe53
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov byte [ebp - 0x221], 0
movzx eax, byte [ebp - 0x221]
test eax, eax
je 0x47f847
push 0x14a4
call dword [sym.imp.KERNEL32.dll_TlsFree]
jmp 0x47f7e6
mov dword [ebp - 0xc8], 0
jmp 0x47f862
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x47f87e
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x33ac], 0x67dcaf6d
jmp 0x47f855
mov dword [ebp - 0x2b00], 0x4879
mov dword [ebp - 0x9c], 0x1afa
push 1
lea ecx, [ebp - 0x1d8c]
call fcn.00433b79
mov dword [ebp - 0x4a4], 0xc6548aab
mov dword [ebp - 0x2f0], 0xffffffff
push 2
lea ecx, [ebp - 0x2880]
call fcn.00433b79
mov dword [ebp - 0x2f8], 0xfffffff8
mov dword [ebp - 0x18], 0
jmp 0x47f8da
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x47f8f3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d8c]
call fcn.00433c67
or dword [eax], 0xffffffff
jmp 0x47f8d3
mov dword [ebp - 0x18], 0
jmp 0x47f903
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x47f919
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x23ac], 0x7c0ec0dc
jmp 0x47f8fc
mov dword [ebp - 0x18], 0
jmp 0x47f929
cmp dword [ebp - 0x18], 2
jge 0x47f945
mov dword [ebp - 0x3d8], 0x1824a8c6
mov dword [ebp - 0x3d8], 0xfffffff3
jmp 0x4822f3
mov eax, dword [ebp - 0x3d8]
inc eax
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 0xfffffff5
je 0x48233a
mov dword [ebp - 0x23b0], 0xffffffff
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x3d8], eax
jle 0x482325
xor eax, eax
inc eax
je 0x482325
mov dword [ebp - 0x134c], 1
jmp 0x48232c
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x134c]
mov dword [ebp - 0x23b0], eax
jmp 0x4822e6
mov byte [ebp - 0x23d], 0
movzx eax, byte [ebp - 0x23d]
test eax, eax
je 0x482367
push 0x1fff
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [ebp - 0x1384], 0xfffffffb
mov dword [ebp - 0x310], 0xeede0b40
mov dword [ebp - 0x1364], 0xfffffff9
mov dword [ebp - 0x2178], 0x25681085
push 2
lea ecx, [ebp - 0x3048]
call fcn.00433b79
mov dword [ebp - 0x137c], 0xe491
mov dword [ebp - 0x744], 0
jmp 0x4823bf
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 2
jge 0x4823e1
push dword [ebp - 0x744]
lea ecx, [ebp - 0x3048]
call fcn.00433c67
mov dword [eax], 0xe1c5a3d7
jmp 0x4823b2
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x32c8], eax
cmp dword [ebp - 0x310], 0
jne 0x482408
cmp dword [ebp - 0x310], 0
jne 0x482408
and dword [ebp - 0x2170], 0
jmp 0x482412
mov dword [ebp - 0x2170], 1
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x310], eax
jge 0x48242c
mov dword [ebp - 0x1354], 1
jmp 0x482433
and dword [ebp - 0x1354], 0
mov eax, dword [ebp - 0x1364]
cmp dword [ebp - 0x1354], eax
jne 0x48244d
mov dword [ebp - 0x22a8], 1
jmp 0x482454
and dword [ebp - 0x22a8], 0
cmp dword [ebp - 0x310], 0
jne 0x48246f
mov eax, 0x66d2
test eax, eax
jne 0x48246f
and dword [ebp - 0x135c], 0
jmp 0x482479
mov dword [ebp - 0x135c], 1
mov eax, dword [ebp - 0x2178]
imul eax, dword [ebp - 0x135c]
cmp eax, 0xfffffffb
jl 0x482497
mov dword [ebp - 0x136c], 1
jmp 0x48249e
and dword [ebp - 0x136c], 0
mov eax, dword [ebp - 0x1364]
cmp dword [ebp - 0x136c], eax
jg 0x4824b8
mov dword [ebp - 0x1374], 1
jmp 0x4824bf
and dword [ebp - 0x1374], 0
mov eax, dword [ebp - 0x1374]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x137c]
inc eax
mov dword [ebp - 0x137c], eax
lea ecx, [ebp - 0x3048]
call fcn.00433c4b
mov dword [ebp - 0x2450], 0x21f997ec
push 2
lea ecx, [ebp - 0x3058]
call fcn.00433b79
mov dword [ebp - 0x754], 0
mov dword [ebp - 0x2c50], 0xfffffffa
mov dword [ebp - 0x74c], 0
jmp 0x482527
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 2
jge 0x482549
push dword [ebp - 0x74c]
lea ecx, [ebp - 0x3058]
call fcn.00433c67
mov dword [eax], 0x13b91020
jmp 0x48251a
mov dword [ebp - 0x754], 0
jmp 0x482562
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 1
jg 0x482614
mov dword [ebp - 0x4cc], 0x2751c76d
mov dword [ebp - 0x4cc], 1
jmp 0x482592
mov eax, dword [ebp - 0x4cc]
dec eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 0
jl 0x48260f
mov dword [ebp - 0x75c], 0xb61bab59
cmp dword [ebp - 0x4cc], 0
je 0x4825b0
jmp 0x48260f
mov dword [ebp - 0x75c], 0
jmp 0x4825c9
mov eax, dword [ebp - 0x75c]
inc eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 1
jg 0x48260a
mov byte [ebp - 0x23f], 0
movzx eax, byte [ebp - 0x23f]
test eax, eax
je 0x482608
push 0x2f9
push 0
push 0
push 0x54e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x4825bc
jmp 0x482585
jmp 0x482555
lea ecx, [ebp - 0x3058]
call fcn.00433c4b
mov dword [ebp - 0x1384], 0x2e25
mov eax, dword [ebp - 0x2450]
cmp dword [ebp - 0x1384], eax
jne 0x482643
mov dword [ebp - 0x138c], 1
jmp 0x48264a
and dword [ebp - 0x138c], 0
mov eax, dword [ebp - 0x138c]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1394], 0xe6da504
mov dword [ebp - 0x970], 0x72b21a35
mov dword [ebp - 0x13ec], 0xa4ccfd6
mov dword [ebp - 0x13b4], 0xfffffff7
mov dword [ebp - 0x76c], 0xfffffffa
mov dword [ebp - 0x2180], 9
mov dword [ebp - 0x764], 0
jmp 0x4826ab
mov eax, dword [ebp - 0x764]
inc eax
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 3
jge 0x4826c7
mov eax, dword [ebp - 0x764]
mov dword [ebp + eax*4 - 0x23dc], 8
jmp 0x48269e
mov dword [ebp - 0x1394], 0
cmp dword [ebp - 0x1394], 0xbf90edca
jae 0x4826e9
mov dword [ebp - 0x13cc], 1
jmp 0x4826f0
and dword [ebp - 0x13cc], 0
mov eax, dword [ebp - 0x970]
mov ecx, dword [ebp - 0x76c]
mov edx, dword [ebp - 0x76c]
dec edx
mov dword [ebp - 0x76c], edx
cmp ecx, eax
jne 0x4827d9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x23dc], 0xfffffffb
jb 0x48272d
mov dword [ebp - 0x139c], 1
jmp 0x482734
and dword [ebp - 0x139c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x23dc]
imul eax, dword [ebp - 0x139c]
mov dword [ebp - 0x970], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax - 0x23dc], ecx
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x23dc], 0x1d97
jne 0x48277e
mov dword [ebp - 0x13a4], 1
jmp 0x482785
and dword [ebp - 0x13a4], 0
mov eax, dword [ebp - 0x13b4]
cmp dword [ebp - 0x13a4], eax
jg 0x48279f
mov dword [ebp - 0x13ac], 1
jmp 0x4827a6
and dword [ebp - 0x13ac], 0
imul eax, dword [ebp - 0x13ac], 0xc178
cmp eax, dword [ebp - 0x76c]
jg 0x4827c4
mov dword [ebp - 0x13bc], 1
jmp 0x4827cb
and dword [ebp - 0x13bc], 0
mov eax, dword [ebp - 0x13b4]
cmp dword [ebp - 0x13bc], eax
jl 0x4827f2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23dc], 0
jne 0x4827f2
and dword [ebp - 0x13c4], 0
jmp 0x4827fc
mov dword [ebp - 0x13c4], 1
mov eax, dword [ebp - 0x2180]
add eax, dword [ebp - 0x13c4]
cmp dword [ebp - 0x13cc], eax
jge 0x48281c
mov dword [ebp - 0x13d4], 1
jmp 0x482823
and dword [ebp - 0x13d4], 0
cmp dword [ebp - 0x13d4], 5
jge 0x482838
mov dword [ebp - 0x13dc], 1
jmp 0x48283f
and dword [ebp - 0x13dc], 0
mov eax, dword [ebp - 0x13ec]
cmp dword [ebp - 0x13dc], eax
jge 0x482859
mov dword [ebp - 0x13e4], 1
jmp 0x482860
and dword [ebp - 0x13e4], 0
mov eax, dword [ebp - 0x13e4]
mov dword [ebp - 0x13ec], eax
mov byte [ebp - 0x241], 0
movzx eax, byte [ebp - 0x241]
test eax, eax
je 0x48288b
push 0
push 0x1655
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
call fcn.00489c42
cdq
push 3
pop ecx
idiv ecx
add edx, 3
imul eax, edx, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x486c9f
mov dword [ebp - 0xc0], 0xb4ffb87
mov dword [ebp - 0x4d4], 0x25ec5604
mov dword [ebp - 0x774], 0
jmp 0x4828d8
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 1
jge 0x4828f4
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x784], 1
jmp 0x4828cb
mov byte [ebp - 0x243], 0
movzx eax, byte [ebp - 0x243]
test eax, eax
je 0x48290c
call dword [sym.imp.USER32.dll_WaitMessage]
mov dword [ebp - 0xc0], 0
jmp 0x482925
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x482cb7
mov dword [ebp - 0xcc], 5
push 2
lea ecx, [ebp - 0x1ea8]
call fcn.00433b79
mov dword [ebp - 0x77c], 0
jmp 0x482962
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 2
jge 0x482984
push dword [ebp - 0x77c]
lea ecx, [ebp - 0x1ea8]
call fcn.00433c67
mov dword [eax], 0x1dbdae4
jmp 0x482955
mov dword [ebp - 0xcc], 0
jmp 0x48299d
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x482b33
mov eax, dword [ebp - 0xc0]
imul ecx, dword [ebp - 0xcc], 0xef90
add ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc0]
add ecx, dword [ebp + edx*4 - 0x784]
imul ecx, dword [ebp - 0xcc]
cmp dword [ebp + eax*4 - 0x784], ecx
jle 0x4829e9
mov dword [ebp - 0x13f4], 1
jmp 0x4829f0
and dword [ebp - 0x13f4], 0
push 0
lea ecx, [ebp - 0x1ea8]
call fcn.00433c67
mov ecx, dword [ebp - 0x13f4]
cmp ecx, dword [eax]
jl 0x482a13
mov dword [ebp - 0x13fc], 1
jmp 0x482a1a
and dword [ebp - 0x13fc], 0
mov eax, dword [ebp - 0x13fc]
add eax, 0x218c00d2
cmp eax, 0xf4a4
jge 0x482a38
mov dword [ebp - 0x1404], 1
jmp 0x482a3f
and dword [ebp - 0x1404], 0
push 0
lea ecx, [ebp - 0x1ea8]
call fcn.00433c67
mov ecx, dword [ebp - 0x1404]
imul ecx, dword [eax]
mov esi, 0x35ca4204
sub esi, ecx
inc esi
push 1
lea ecx, [ebp - 0x1ea8]
call fcn.00433c67
cmp esi, dword [eax]
jge 0x482a7a
mov dword [ebp - 0x140c], 1
jmp 0x482a81
and dword [ebp - 0x140c], 0
push 1
lea ecx, [ebp - 0x1ea8]
call fcn.00433c67
mov ecx, dword [ebp - 0x140c]
cmp ecx, dword [eax]
jl 0x482aa4
mov dword [ebp - 0x1414], 1
jmp 0x482aab
and dword [ebp - 0x1414], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1414], eax
jl 0x482ac5
mov dword [ebp - 0x141c], 1
jmp 0x482acc
and dword [ebp - 0x141c], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x141c], eax
je 0x482ae6
mov dword [ebp - 0x1424], 1
jmp 0x482aed
and dword [ebp - 0x1424], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x784]
cmp dword [ebp - 0x1424], eax
jl 0x482b0e
mov dword [ebp - 0x142c], 1
jmp 0x482b15
and dword [ebp - 0x142c], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x784]
add eax, dword [ebp - 0x142c]
mov dword [ebp - 0x4d4], eax
jmp 0x482990
mov dword [ebp - 0x4d4], 0
jmp 0x482b4c
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0
jg 0x482ca7
mov dword [ebp - 0xcc], 0
jmp 0x482b72
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jg 0x482ca2
mov dword [ebp - 0x78c], 0xbee6daba
mov dword [ebp - 0x78c], 0
jmp 0x482ba2
mov eax, dword [ebp - 0x78c]
dec eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 0
jl 0x482c7f
push 2
lea ecx, [ebp - 0x23ec]
call fcn.00433b79
mov dword [ebp - 0x794], 0
jmp 0x482bd5
mov eax, dword [ebp - 0x794]
inc eax
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 2
jge 0x482bf7
push dword [ebp - 0x794]
lea ecx, [ebp - 0x23ec]
call fcn.00433c67
mov dword [eax], 0x2506ed55
jmp 0x482bc8
push 1
lea ecx, [ebp - 0x23ec]
call fcn.00433c67
mov dword [eax], 1
jmp 0x482c30
push 1
lea ecx, [ebp - 0x23ec]
call fcn.00433c67
mov dword [ebp - 0x1434], eax
mov eax, dword [ebp - 0x1434]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1434]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x23ec]
call fcn.00433c67
cmp dword [eax], 0
jl 0x482c6f
mov byte [ebp - 0x245], 0
movzx eax, byte [ebp - 0x245]
test eax, eax
je 0x482c6d
push 0x4ab
push 0x2182
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x482c0c
lea ecx, [ebp - 0x23ec]
call fcn.00433c4b
jmp 0x482b95
mov byte [ebp - 0x247], 0
movzx eax, byte [ebp - 0x247]
test eax, eax
je 0x482c9d
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x482b65
jmp 0x482b3f
lea ecx, [ebp - 0x1ea8]
call fcn.00433c4b
jmp 0x482918
xor ecx, ecx
call fcn.00433ee4
push eax
call fcn.00489c63
pop ecx
mov dword [ebp - 0x4dc], 0xdb3ae355
mov dword [ebp - 0x980], 8
mov dword [ebp - 0x990], 0x6a191a83
mov dword [ebp - 0x4dc], 0
jmp 0x482cfc
mov eax, dword [ebp - 0x4dc]
dec eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0xffffffe6
jl 0x482f51
mov dword [ebp - 0x988], 0xc61c71bc
mov dword [ebp - 0x978], 0xb7ab61b5
mov dword [ebp - 0x200], 0xffffffff
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x2fec], eax
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x2c58], eax
mov dword [ebp - 0x978], 0xffffffff
cmp dword [ebp - 0x978], 0xc
jl 0x482d5e
mov dword [ebp - 0x143c], 1
jmp 0x482d65
and dword [ebp - 0x143c], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x143c], eax
jg 0x482d7f
mov dword [ebp - 0x1444], 1
jmp 0x482d86
and dword [ebp - 0x1444], 0
mov eax, dword [ebp - 0x1444]
mov dword [ebp - 0x980], eax
cmp dword [ebp - 0x980], 0
je 0x482db0
cmp dword [ebp - 0x200], 0
je 0x482db0
mov dword [ebp - 0x144c], 1
jmp 0x482db7
and dword [ebp - 0x144c], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x144c], eax
jge 0x482dd1
mov dword [ebp - 0x1454], 1
jmp 0x482dd8
and dword [ebp - 0x1454], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x1454], eax
je 0x482df2
mov dword [ebp - 0x145c], 1
jmp 0x482df9
and dword [ebp - 0x145c], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x145c], eax
jge 0x482e13
mov dword [ebp - 0x1464], 1
jmp 0x482e1a
and dword [ebp - 0x1464], 0
cmp dword [ebp - 0x1464], 0
je 0x482e34
xor eax, eax
inc eax
je 0x482e34
mov dword [ebp - 0x146c], 1
jmp 0x482e3b
and dword [ebp - 0x146c], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x146c], eax
jl 0x482e5b
cmp dword [ebp - 0x990], 0
jne 0x482e5b
and dword [ebp - 0x22b0], 0
jmp 0x482e65
mov dword [ebp - 0x22b0], 1
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x3194], eax
mov eax, 0x3fde
test eax, eax
jge 0x482e86
mov dword [ebp - 0x1474], 1
jmp 0x482e8d
and dword [ebp - 0x1474], 0
mov eax, dword [ebp - 0x988]
add eax, dword [ebp - 0x1474]
mov dword [ebp - 0x2188], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x23c0], eax
mov eax, dword [ebp - 0x988]
dec eax
mov dword [ebp - 0x988], eax
mov eax, dword [ebp - 0x2188]
cmp eax, dword [ebp - 0x23c0]
jg 0x482ed2
mov dword [ebp - 0x147c], 1
jmp 0x482ed9
and dword [ebp - 0x147c], 0
cmp dword [ebp - 0x147c], 0xffff
je 0x482ef7
mov eax, 0x6a1c
test eax, eax
jne 0x482ef7
and dword [ebp - 0x1484], 0
jmp 0x482f01
mov dword [ebp - 0x1484], 1
mov eax, dword [ebp - 0x990]
cmp dword [ebp - 0x1484], eax
je 0x482f1b
mov dword [ebp - 0x148c], 1
jmp 0x482f22
and dword [ebp - 0x148c], 0
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0x148c]
mov dword [ebp - 0x990], eax
mov byte [ebp - 0x249], 0
movzx eax, byte [ebp - 0x249]
test eax, eax
je 0x482f4c
call dword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x482cef
mov dword [ebp - 0x79c], 0x824a8c6a
mov dword [ebp - 0x79c], 0xfffffff9
jmp 0x482f74
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0xffffffff
jne 0x4830ff
mov dword [ebp - 0x7ac], 1
mov dword [ebp - 0x7a4], 0
jmp 0x482fa4
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 1
jge 0x482fc0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp + eax*4 - 0x2c60], 0xffffffff
jmp 0x482f97
mov dword [ebp - 0x7ac], 0
jmp 0x482fd9
mov eax, dword [ebp - 0x7ac]
inc eax
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 0
jg 0x4830fa
push 3
lea ecx, [ebp - 0x23fc]
call fcn.00433b79
mov dword [ebp - 0x7b4], 0
jmp 0x48300c
mov eax, dword [ebp - 0x7b4]
inc eax
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x7b4], 3
jge 0x48302e
push dword [ebp - 0x7b4]
lea ecx, [ebp - 0x23fc]
call fcn.00433c67
mov dword [eax], 0x629aa810
jmp 0x482fff
push 2
lea ecx, [ebp - 0x23fc]
call fcn.00433c67
and dword [eax], 0
jmp 0x483064
push 2
lea ecx, [ebp - 0x23fc]
call fcn.00433c67
mov dword [ebp - 0x1494], eax
mov eax, dword [ebp - 0x1494]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1494]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x23fc]
call fcn.00433c67
cmp dword [eax], 0
jg 0x4830ea
mov dword [ebp - 0x7bc], 1
mov dword [ebp - 0x7bc], 0
jmp 0x483099
mov eax, dword [ebp - 0x7bc]
dec eax
mov dword [ebp - 0x7bc], eax
cmp dword [ebp - 0x7bc], 0
jl 0x4830c3
mov byte [ebp - 0x24b], 0
movzx eax, byte [ebp - 0x24b]
test eax, eax
je 0x4830c1
push 0x1a03
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x48308c
mov byte [ebp - 0x24d], 0
movzx eax, byte [ebp - 0x24d]
test eax, eax
je 0x4830e5
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
jmp 0x483040
lea ecx, [ebp - 0x23fc]
call fcn.00433c4b
jmp 0x482fcc
jmp 0x482f67
mov byte [ebp - 0x24f], 0
movzx eax, byte [ebp - 0x24f]
test eax, eax
je 0x483128
push 0x2371
push 0x64a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov dword [ebp - 0xf0], 9
mov dword [ebp - 0x2190], 0xb064bae0
mov dword [ebp - 0x2ffc], 0xa1f0
mov dword [ebp - 0x7c4], 0
jmp 0x48315f
mov eax, dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 1
jge 0x48317b
mov eax, dword [ebp - 0x7c4]
mov dword [ebp + eax*4 - 0x22b8], 0xffffffff
jmp 0x483152
mov dword [ebp - 0xf0], 0
jmp 0x483194
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xffffffef
jge 0x48331d
mov dword [ebp - 0x208], 4
push 1
lea ecx, [ebp - 0x25d8]
call fcn.00433b79
mov dword [ebp - 0x7cc], 0
jmp 0x4831d1
mov eax, dword [ebp - 0x7cc]
inc eax
mov dword [ebp - 0x7cc], eax
cmp dword [ebp - 0x7cc], 1
jge 0x4831f3
push dword [ebp - 0x7cc]
lea ecx, [ebp - 0x25d8]
call fcn.00433c67
mov dword [eax], 0xfffffff9
jmp 0x4831c4
cmp dword [ebp - 0xf0], 0
je 0x48320c
lea ecx, [ebp - 0x25d8]
call fcn.00433c4b
jmp 0x48331d
mov dword [ebp - 0x208], 0
jmp 0x483225
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xffffffe9
je 0x48330d
mov dword [ebp - 0x998], 0x289a
cmp dword [ebp - 0x998], 0
jne 0x483251
mov dword [ebp - 0x14a4], 1
jmp 0x483258
and dword [ebp - 0x14a4], 0
cmp dword [ebp - 0x208], 0xfffffff9
jge 0x48326d
mov dword [ebp - 0x149c], 1
jmp 0x483274
and dword [ebp - 0x149c], 0
mov eax, dword [ebp - 0x998]
add eax, dword [ebp - 0x149c]
add eax, dword [ebp - 0x208]
imul eax, dword [ebp - 0x14a4]
cmp dword [ebp - 0x998], eax
jle 0x4832a1
mov dword [ebp - 0x14ac], 1
jmp 0x4832a8
and dword [ebp - 0x14ac], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x14ac], eax
jge 0x4832c2
mov dword [ebp - 0x14b4], 1
jmp 0x4832c9
and dword [ebp - 0x14b4], 0
mov eax, dword [ebp - 0x14b4]
sub eax, dword [ebp - 0x208]
je 0x4832f5
push 0
lea ecx, [ebp - 0x25d8]
call fcn.00433c67
cmp dword [eax], 0
je 0x4832f5
mov dword [ebp - 0x14bc], 1
jmp 0x4832fc
and dword [ebp - 0x14bc], 0
mov eax, dword [ebp - 0x14bc]
mov dword [ebp - 0x2190], eax
jmp 0x483218
lea ecx, [ebp - 0x25d8]
call fcn.00433c4b
jmp 0x483187
mov dword [ebp - 0xf0], 0
jmp 0x483336
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x483352
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x22b8], 0x2c5b641b
jmp 0x483329
mov dword [ebp - 0x8c], 0x9da4d073
mov dword [ebp - 0x3e0], 0x591
mov dword [ebp - 0x210], 0x21324561
mov dword [ebp - 0x7dc], 0x61d594d0
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x2198], 0x92f1e5c8
push 1
lea ecx, [ebp - 0x3068]
call fcn.00433b79
mov dword [ebp - 0x7d4], 0
jmp 0x4833b4
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 1
jge 0x4833d6
push dword [ebp - 0x7d4]
lea ecx, [ebp - 0x3068]
call fcn.00433c67
mov dword [eax], 0xfc24
jmp 0x4833a7
cmp dword [ebp - 0x8c], 0x82ff40fc
jne 0x4833ee
mov dword [ebp - 0x14cc], 1
jmp 0x4833f5
and dword [ebp - 0x14cc], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jge 0x483415
cmp dword [ebp - 0x3e0], 0
jne 0x483415
and dword [ebp - 0x14c4], 0
jmp 0x48341f
mov dword [ebp - 0x14c4], 1
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x14c4]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x8c], eax
jg 0x48344b
mov dword [ebp - 0x14d4], 1
jmp 0x483452
and dword [ebp - 0x14d4], 0
mov eax, dword [ebp - 0x14cc]
cmp eax, dword [ebp - 0x14d4]
je 0x48346c
mov dword [ebp - 0x14dc], 1
jmp 0x483473
and dword [ebp - 0x14dc], 0
mov eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0
je 0x4834a9
cmp dword [ebp - 0x3e0], 0
je 0x4834a9
mov dword [ebp - 0x14e4], 1
jmp 0x4834b0
and dword [ebp - 0x14e4], 0
mov eax, dword [ebp - 0x14e4]
mov dword [ebp - 0x3e8], eax
or eax, 0xffffffff
sub eax, dword [ebp - 0x3e8]
imul eax, dword [ebp - 0x2198]
test eax, eax
je 0x48352e
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x210]
jg 0x4834f0
mov dword [ebp - 0x14ec], 1
jmp 0x4834f7
and dword [ebp - 0x14ec], 0
cmp dword [ebp - 0x14ec], 0x695c
jge 0x48350f
mov dword [ebp - 0x14f4], 1
jmp 0x483516
and dword [ebp - 0x14f4], 0
cmp dword [ebp - 0x14f4], 0xf9a4
jl 0x48352e
mov dword [ebp - 0x14fc], 1
jmp 0x483535
and dword [ebp - 0x14fc], 0
mov eax, dword [ebp - 0x14fc]
neg eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 1
jl 0x483558
mov dword [ebp - 0x1504], 1
jmp 0x48355f
and dword [ebp - 0x1504], 0
mov eax, dword [ebp - 0x1504]
sub eax, dword [ebp - 0x8c]
je 0x4835d8
push 2
lea ecx, [ebp - 0x28d4]
call fcn.00433b79
mov dword [ebp - 0x7e4], 0
jmp 0x483593
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 2
jge 0x4835b5
push dword [ebp - 0x7e4]
lea ecx, [ebp - 0x28d4]
call fcn.00433c67
mov dword [eax], 5
jmp 0x483586
push 1
lea ecx, [ebp - 0x28d4]
call fcn.00433c67
mov dword [eax], 0x10cbbbc2
lea ecx, [ebp - 0x28d4]
call fcn.00433c4b
jmp 0x4836bd
mov dword [ebp - 0x150c], 0x3de76903
mov dword [ebp - 0x3e0], 0x1d
jmp 0x4835fb
mov eax, dword [ebp - 0x3e0]
dec eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0xd
je 0x4836b0
mov dword [ebp - 0x210], 0
jmp 0x483621
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jg 0x483649
mov byte [ebp - 0x251], 0
movzx eax, byte [ebp - 0x251]
test eax, eax
je 0x483647
push 0x1fd3
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x483614
mov dword [ebp - 0x3e8], 0xffffffe6
jmp 0x483662
mov eax, dword [ebp - 0x3e8]
inc eax
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0x19
jne 0x4836ab
mov dword [ebp - 0x8c], 0
jmp 0x483684
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x4836a9
mov byte [ebp - 0x253], 0
movzx eax, byte [ebp - 0x253]
test eax, eax
je 0x4836a7
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x483677
jmp 0x483655
jmp 0x4835ee
mov eax, dword [ebp - 0x150c]
inc eax
mov dword [ebp - 0x150c], eax
lea ecx, [ebp - 0x3068]
call fcn.00433c4b
mov dword [ebp - 0x120], 0x125d16df
mov dword [ebp - 0x9a0], 0xe3f9150f
mov dword [ebp - 0x4e4], 8
mov dword [ebp - 0x1564], 1
mov dword [ebp - 0x2478], 0xe45661c4
mov dword [ebp - 0x7ec], 0
jmp 0x483713
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 3
jge 0x48372f
mov eax, dword [ebp - 0x7ec]
mov dword [ebp + eax*4 - 0x8b8], 1
jmp 0x483706
mov dword [ebp - 0x120], 0
jmp 0x483748
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jg 0x48377f
mov eax, dword [ebp - 0x120]
cmp dword [ebp + eax*4 - 0x8b8], 0
je 0x483763
jmp 0x48377f
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x120]
mov eax, dword [ebp + eax*4 - 0x8b8]
mov dword [ebp + ecx*4 - 0x8b8], eax
jmp 0x48373b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b8]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x8b8]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0x2c68], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8b8]
mov dword [ebp - 0x3290], eax
cmp dword [ebp - 0x9a0], 0
jg 0x4837d1
mov dword [ebp - 0x1514], 1
jmp 0x4837d8
and dword [ebp - 0x1514], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b8]
cmp dword [ebp - 0x1514], eax
jge 0x4837fa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8b8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8b8], 0x3de4
jle 0x483818
mov dword [ebp - 0x151c], 1
jmp 0x48381f
and dword [ebp - 0x151c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b8]
cmp eax, dword [ebp - 0x151c]
jne 0x48383f
mov dword [ebp - 0x1524], 1
jmp 0x483846
and dword [ebp - 0x1524], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8b8]
neg eax
mov ecx, dword [ebp - 0x4e4]
imul ecx, dword [ebp - 0x1524]
imul eax, ecx
cmp eax, dword [ebp - 0x4e4]
jge 0x483878
mov dword [ebp - 0x152c], 1
jmp 0x48387f
and dword [ebp - 0x152c], 0
mov dword [ebp - 0x120], 9
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x152c]
jne 0x4838a3
mov dword [ebp - 0x1534], 1
jmp 0x4838aa
and dword [ebp - 0x1534], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x1534], eax
jle 0x4838c4
mov dword [ebp - 0x153c], 1
jmp 0x4838cb
and dword [ebp - 0x153c], 0
mov eax, dword [ebp - 0x153c]
add eax, 0xd3d4
je 0x4838f3
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8b8], 0
je 0x4838f3
mov dword [ebp - 0x1544], 1
jmp 0x4838fa
and dword [ebp - 0x1544], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x1544], eax
jg 0x483914
mov dword [ebp - 0x154c], 1
jmp 0x48391b
and dword [ebp - 0x154c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8b8]
cmp dword [ebp - 0x154c], eax
je 0x48393c
mov dword [ebp - 0x1554], 1
jmp 0x483943
and dword [ebp - 0x1554], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x1554], eax
jge 0x48395d
mov dword [ebp - 0x155c], 1
jmp 0x483964
and dword [ebp - 0x155c], 0
mov eax, dword [ebp - 0x155c]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x1564]
mov dword [ebp - 0x2478], eax
mov dword [ebp - 0x1574], 0xffffffff
mov dword [ebp - 0x1584], 1
and dword [ebp - 0x2868], 0
and dword [ebp - 0x2864], 0
and dword [ebp - 0x2860], 0
and dword [ebp - 0x285c], 0
lea ecx, [ebp - 0xa45]
call fcn.00433c76
push eax
lea eax, [ebp - 0x2858]
push eax
lea eax, [ebp - 0x2868]
push eax
lea ecx, [ebp - 0x34b4]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3078]
call fcn.00433c25
mov dword [ebp - 0x1594], 0xffffffff
mov dword [ebp - 0x15a4], 0
mov dword [ebp - 0x22c0], 0xc353
mov dword [ebp - 0x21a8], 0xed693765
mov dword [ebp - 0x128], 0
jmp 0x483a22
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x483a3e
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x1bac], 0x937d8e6e
jmp 0x483a15
mov dword [ebp - 0x128], 0
jmp 0x483a57
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x483a73
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x3514], 0
jmp 0x483a4a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1bac], 0
je 0x483bcc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1bac]
mov dword [ebp - 0x2c70], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bac]
mov dword [ebp - 0x300c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1bac], 0xfffffffe
jle 0x483ac6
mov dword [ebp - 0x156c], 1
jmp 0x483acd
and dword [ebp - 0x156c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bac]
imul eax, dword [ebp - 0x156c]
mov dword [ebp - 0x1574], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bac]
cmp dword [ebp - 0x1574], eax
jne 0x483b06
mov dword [ebp - 0x21a0], 1
jmp 0x483b0d
and dword [ebp - 0x21a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bac]
mov dword [ebp - 0x2c78], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1bac]
mov dword [ebp - 0x319c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x1bac]
cmp dword [ebp + eax - 0x1bac], ecx
jge 0x483b59
mov dword [ebp - 0x157c], 1
jmp 0x483b60
and dword [ebp - 0x157c], 0
mov eax, dword [ebp - 0x157c]
mov dword [ebp - 0x1584], eax
mov eax, dword [ebp - 0x1584]
mov dword [ebp - 0x158c], eax
push 2
lea ecx, [ebp - 0x3078]
call fcn.00433c67
mov ecx, dword [ebp - 0x158c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x158c]
mov dword [ebp - 0x1594], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bac]
cmp dword [ebp - 0x1594], eax
je 0x483bbc
xor eax, eax
inc eax
jne 0x483bbc
and dword [ebp - 0x159c], 0
jmp 0x483bc6
mov dword [ebp - 0x159c], 1
mov eax, dword [ebp - 0x15a4]
mov eax, dword [ebp - 0x15a4]
cmp dword [ebp - 0x22c0], eax
jl 0x483be6
mov dword [ebp - 0x15ac], 1
jmp 0x483bed
and dword [ebp - 0x15ac], 0
mov eax, dword [ebp - 0x15ac]
mov dword [ebp - 0x21a8], eax
lea ecx, [ebp - 0x3078]
call fcn.00433c4b
mov dword [ebp - 0x318], 0xffffffff
mov dword [ebp - 0x318], 0
jmp 0x483c27
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xfffffffa
jle 0x483cd9
mov dword [ebp - 0x7f4], 0xa290be4
mov dword [ebp - 0x23d0], 0
cmp dword [ebp - 0x318], 2
jbe 0x483c5d
mov dword [ebp - 0x15b4], 1
jmp 0x483c64
and dword [ebp - 0x15b4], 0
mov eax, dword [ebp - 0x15b4]
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 0
jne 0x483c90
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x7f4], eax
jl 0x483c90
and dword [ebp - 0x15bc], 0
jmp 0x483c9a
mov dword [ebp - 0x15bc], 1
mov eax, dword [ebp - 0x7f4]
mov ecx, 0xfff8
sub ecx, dword [ebp - 0x318]
sub eax, ecx
cmp dword [ebp - 0x15bc], eax
je 0x483cc1
mov dword [ebp - 0x15c4], 1
jmp 0x483cc8
and dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x15c4]
mov dword [ebp - 0x23d0], eax
jmp 0x483c1a
mov byte [ebp - 0x255], 0
movzx eax, byte [ebp - 0x255]
test eax, eax
je 0x483d07
push 0
push 0x1aa6
push 0x1d08
push 0x1a80
push 0xe53
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x90], 0xdb58e469
mov dword [ebp - 0x21b8], 0
mov dword [ebp - 0x2458], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x90], 0xffffffe3
jmp 0x483d4a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x11
jge 0x483f33
mov dword [ebp - 0x4ec], 0xfffffffb
mov dword [ebp - 0x22c8], 0x66de6b93
mov byte [ebp - 0x257], 0
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x483dac
push 0x14d8
push 0x18fc
push 0x2056
push 0xfca
push 0x6d
push 0x1bcd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
cmp dword [ebp - 0x90], 0xffff0003
jge 0x483dc4
mov dword [ebp - 0x15f4], 1
jmp 0x483dcb
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x4ec], eax
je 0x483de5
mov dword [ebp - 0x15cc], 1
jmp 0x483dec
and dword [ebp - 0x15cc], 0
cmp dword [ebp - 0x15cc], 0x7263
jl 0x483e04
mov dword [ebp - 0x21b0], 1
jmp 0x483e0b
and dword [ebp - 0x21b0], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x2c80], eax
cmp dword [ebp - 0x90], 0xfffe
jb 0x483e2f
mov dword [ebp - 0x15d4], 1
jmp 0x483e36
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0x15d4]
neg eax
cmp eax, 0x7b1b
je 0x483e5a
cmp dword [ebp - 0x22c8], 0
je 0x483e5a
mov dword [ebp - 0x15dc], 1
jmp 0x483e61
and dword [ebp - 0x15dc], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x15dc], eax
jle 0x483e7b
mov dword [ebp - 0x15e4], 1
jmp 0x483e82
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x15e4], eax
jl 0x483e99
cmp dword [ebp - 0x21b8], 0
je 0x483eae
cmp dword [ebp - 0x2458], 0
je 0x483eae
mov dword [ebp - 0x21c0], 1
jmp 0x483eb5
and dword [ebp - 0x21c0], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x301c], eax
cmp dword [ebp - 0x4ec], 0x94d0e83
jg 0x483ed9
mov dword [ebp - 0x15ec], 1
jmp 0x483ee0
and dword [ebp - 0x15ec], 0
mov eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0x15ec]
jg 0x483efa
mov dword [ebp - 0x15fc], 1
jmp 0x483f01
and dword [ebp - 0x15fc], 0
mov eax, dword [ebp - 0x15f4]
cmp eax, dword [ebp - 0x15fc]
jl 0x483f1b
mov dword [ebp - 0x1604], 1
jmp 0x483f22
and dword [ebp - 0x1604], 0
mov eax, dword [ebp - 0x1604]
mov dword [ebp - 0x4ec], eax
jmp 0x483d3d
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xaa124c
push 0xaa124c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0x9f8], eax
and dword [ebp - 0x27b4], 0
and dword [ebp - 0x27b0], 0
and dword [ebp - 0x27ac], 0
and dword [ebp - 0x27a8], 0
lea ecx, [ebp - 0xa4d]
call fcn.00433c76
push eax
lea eax, [ebp - 0x27a4]
push eax
lea eax, [ebp - 0x27b4]
push eax
lea ecx, [ebp - 0x34c4]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x518]
call fcn.00433c25
mov dword [ebp - 0x4c], 0xd4081c29
mov dword [ebp - 0x168c], 0x9d070fee
mov dword [ebp - 0x1674], 0
mov dword [ebp - 0x7fc], 0
jmp 0x483feb
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 3
jge 0x484007
mov eax, dword [ebp - 0x7fc]
mov dword [ebp + eax*4 - 0x2578], 0x452a2c7a
jmp 0x483fde
mov dword [ebp - 0x4c], 3
jmp 0x484017
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x4844ca
mov dword [ebp - 0xb4], 0xfffffffa
push 1
lea ecx, [ebp - 0x2638]
call fcn.00433b79
mov dword [ebp - 0x22d0], 0xfffffff9
mov dword [ebp - 0x1654], 0x739425a3
mov dword [ebp - 0x21c8], 0xfffffffc
mov dword [ebp - 0x804], 0
jmp 0x48406f
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 1
jge 0x484091
push dword [ebp - 0x804]
lea ecx, [ebp - 0x2638]
call fcn.00433c67
mov dword [eax], 0x21aa2910
jmp 0x484062
mov dword [ebp - 0xb4], 3
jmp 0x4840aa
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x4844ba
mov dword [ebp - 0x80c], 0x598737a
mov dword [ebp - 0x163c], 0
mov dword [ebp - 0x9a8], 0x80d7777b
mov dword [ebp - 0x16b4], 0x90f9cf5
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov eax, dword [eax]
neg eax
cmp eax, dword [ebp - 0xb4]
jge 0x484105
mov dword [ebp - 0x160c], 1
jmp 0x48410c
and dword [ebp - 0x160c], 0
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov eax, dword [eax]
cmp eax, dword [ebp - 0x160c]
jl 0x484133
mov dword [ebp - 0x165c], 1
jmp 0x48413a
and dword [ebp - 0x165c], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x2c88], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
push 3
lea ecx, [ebp - 0x518]
call fcn.00433c67
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov eax, dword [eax]
add eax, 0xc22c
cmp eax, 0xdd7582ba
je 0x4841b1
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
cmp dword [eax], 0
je 0x4841b1
push 0
lea ecx, [ebp - 0x2638]
call fcn.00433c67
cmp dword [eax], 0
je 0x4841b1
mov dword [ebp - 0x1614], 1
jmp 0x4841b8
and dword [ebp - 0x1614], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov ecx, dword [ebp - 0x1614]
cmp ecx, dword [eax]
jg 0x4841dc
mov dword [ebp - 0x161c], 1
jmp 0x4841e3
and dword [ebp - 0x161c], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov ecx, dword [ebp - 0x161c]
imul ecx, dword [eax]
mov dword [ebp - 0x1624], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1624]
mov dword [ebp + eax - 0x2578], ecx
cmp dword [ebp - 0x1624], 0
jne 0x484228
mov dword [ebp - 0x162c], 1
jmp 0x48422f
and dword [ebp - 0x162c], 0
mov eax, dword [ebp - 0x162c]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x32ec], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2578]
mov dword [ebp - 0x2c90], eax
push 3
lea ecx, [ebp - 0x518]
call fcn.00433c67
imul eax, dword [ebp - 0x163c], 0xfe57
cmp eax, dword [ebp - 0x22d0]
jge 0x484285
mov dword [ebp - 0x1634], 1
jmp 0x48428c
and dword [ebp - 0x1634], 0
mov eax, dword [ebp - 0x168c]
cmp dword [ebp - 0x1634], eax
jne 0x4842af
cmp dword [ebp - 0xb4], 0
je 0x4842af
mov dword [ebp - 0x1644], 1
jmp 0x4842b6
and dword [ebp - 0x1644], 0
mov eax, dword [ebp - 0x163c]
cmp dword [ebp - 0x1644], eax
jle 0x4842d0
mov dword [ebp - 0x164c], 1
jmp 0x4842d7
and dword [ebp - 0x164c], 0
mov eax, dword [ebp - 0x164c]
mov dword [ebp - 0x1654], eax
mov eax, dword [ebp - 0x1654]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
cmp dword [ebp - 0x165c], eax
jle 0x484309
mov dword [ebp - 0x1664], 1
jmp 0x484310
and dword [ebp - 0x1664], 0
push 0
lea ecx, [ebp - 0x2638]
call fcn.00433c67
mov ecx, dword [ebp - 0x1664]
add ecx, dword [eax]
mov dword [ebp - 0x21c8], ecx
push 1
lea ecx, [ebp - 0x518]
call fcn.00433c67
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2578]
mov dword [ebp - 0x302c], eax
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x1674]
je 0x48437a
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x518]
call fcn.00433c67
cmp dword [eax], 0
je 0x48437a
mov dword [ebp - 0x166c], 1
jmp 0x484381
and dword [ebp - 0x166c], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x166c]
cmp eax, dword [ebp - 0x1674]
jge 0x48439f
mov dword [ebp - 0x167c], 1
jmp 0x4843a6
and dword [ebp - 0x167c], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov ecx, dword [ebp - 0x167c]
cmp ecx, dword [eax]
jg 0x4843ca
mov dword [ebp - 0x1684], 1
jmp 0x4843d1
and dword [ebp - 0x1684], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x518]
call fcn.00433c67
mov ecx, dword [ebp - 0x1684]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x168c]
jg 0x4843fb
mov dword [ebp - 0x1694], 1
jmp 0x484402
and dword [ebp - 0x1694], 0
cmp dword [ebp - 0x1694], 0xfffffff8
jb 0x484417
mov dword [ebp - 0x169c], 1
jmp 0x48441e
and dword [ebp - 0x169c], 0
cmp dword [ebp - 0x169c], 0xb627
jle 0x484436
mov dword [ebp - 0x16a4], 1
jmp 0x48443d
and dword [ebp - 0x16a4], 0
mov esi, dword [ebp - 0x4c]
add esi, dword [ebp - 0x16a4]
push 3
lea ecx, [ebp - 0x518]
call fcn.00433c67
sub esi, dword [eax]
mov dword [ebp - 0x16ac], esi
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x16ac]
mov dword [ebp + eax - 0x2578], ecx
mov eax, dword [ebp - 0x16ac]
mov dword [ebp - 0x16b4], eax
mov eax, dword [ebp - 0x16b4]
cmp dword [ebp - 0x4c], eax
je 0x484496
or eax, 0xffffffff
je 0x484496
mov dword [ebp - 0x16bc], 1
jmp 0x48449d
and dword [ebp - 0x16bc], 0
mov eax, dword [ebp - 0x16bc]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x9a8], eax
jmp 0x48409d
lea ecx, [ebp - 0x2638]
call fcn.00433c4b
jmp 0x484010
lea ecx, [ebp - 0x518]
call fcn.00433c4b
mov dword [ebp - 0x26d8], 1
mov dword [ebp - 0x26d4], 1
mov dword [ebp - 0x26d0], 1
mov dword [ebp - 0x26cc], 1
lea ecx, [ebp - 0xa55]
call fcn.00433c76
push eax
lea eax, [ebp - 0x26c8]
push eax
lea eax, [ebp - 0x26d8]
push eax
lea ecx, [ebp - 0x34dc]
call fcn.00433c79
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x33d0]
call fcn.00433c25
mov dword [ebp - 0x814], 0xfffffff6
mov dword [ebp - 0x814], 0
jmp 0x484555
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 3
jg 0x48459a
mov byte [ebp - 0x259], 0
movzx eax, byte [ebp - 0x259]
test eax, eax
je 0x484598
push 0
push 0xa4a
push 0xf63
push 0xcf5
push 0x180
push 0xb8a
push 0x639
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x484548
lea ecx, [ebp - 0x33d0]
call fcn.00433c4b
mov dword [ebp - 0x70], 0xfffffffd
push 1
lea ecx, [ebp - 0x240c]
call fcn.00433b79
mov dword [ebp - 0x130], 0
jmp 0x4845d2
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x4845ee
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x88], 9
jmp 0x4845c5
mov dword [ebp - 0x130], 0
jmp 0x484607
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x484629
push dword [ebp - 0x130]
lea ecx, [ebp - 0x240c]
call fcn.00433c67
mov dword [eax], 0xb47e0fa1
jmp 0x4845fa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x484675
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
jae 0x48465b
mov dword [ebp - 0x16c4], 1
jmp 0x484662
and dword [ebp - 0x16c4], 0
mov eax, dword [ebp - 0x16c4]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x484675
cmp dword [ebp - 0x70], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x88]
cmp dword [ebp + eax - 0x88], ecx
jne 0x48469d
mov dword [ebp - 0x16cc], 1
jmp 0x4846a4
and dword [ebp - 0x16cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
cmp dword [ebp - 0x16cc], eax
jge 0x4846cb
cmp dword [ebp - 0x70], 0
je 0x4846cb
mov dword [ebp - 0x16d4], 1
jmp 0x4846d2
and dword [ebp - 0x16d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x88]
cmp eax, dword [ebp - 0x16d4]
jle 0x4846f3
mov dword [ebp - 0x16dc], 1
jmp 0x4846fa
and dword [ebp - 0x16dc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x16dc]
sub ecx, dword [ebp + eax - 0x88]
je 0x48472b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
je 0x48472b
mov dword [ebp - 0x16e4], 1
jmp 0x484732
and dword [ebp - 0x16e4], 0
mov eax, dword [ebp - 0x16e4]
add eax, 0x82e5
cmp eax, 2
je 0x484751
cmp dword [ebp - 0x70], 0
jne 0x484751
and dword [ebp - 0x16ec], 0
jmp 0x48475b
mov dword [ebp - 0x16ec], 1
cmp dword [ebp - 0x16ec], 1
jbe 0x484770
mov dword [ebp - 0x16f4], 1
jmp 0x484777
and dword [ebp - 0x16f4], 0
cmp dword [ebp - 0x16f4], 0xfffffffb
jbe 0x48478c
mov dword [ebp - 0x16fc], 1
jmp 0x484793
and dword [ebp - 0x16fc], 0
mov eax, dword [ebp - 0x16fc]
add eax, 7
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x88]
cmp eax, 0xfffffffb
jne 0x4847ba
mov dword [ebp - 0x1704], 1
jmp 0x4847c1
and dword [ebp - 0x1704], 0
mov eax, dword [ebp - 0x1704]
neg eax
jne 0x4847e4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
jne 0x4847e4
and dword [ebp - 0x170c], 0
jmp 0x4847ee
mov dword [ebp - 0x170c], 1
push 0
lea ecx, [ebp - 0x240c]
call fcn.00433c67
mov ecx, dword [ebp - 0x170c]
mov dword [eax], ecx
mov dword [ebp - 0x70], 0
jmp 0x484813
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jg 0x4848de
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x88], 0
jne 0x48483f
mov eax, 0xae05
test eax, eax
jne 0x48483f
and dword [ebp - 0x23e0], 0
jmp 0x484849
mov dword [ebp - 0x23e0], 1
push 0
lea ecx, [ebp - 0x240c]
call fcn.00433c67
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x88]
dec eax
dec eax
je 0x484879
mov eax, 0xfffe
test eax, eax
je 0x484879
mov dword [ebp - 0x1714], 1
jmp 0x484880
and dword [ebp - 0x1714], 0
cmp dword [ebp - 0x1714], 0x323fa9df
je 0x484898
mov dword [ebp - 0x171c], 1
jmp 0x48489f
and dword [ebp - 0x171c], 0
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x88]
cmp dword [ebp - 0x171c], eax
jne 0x4848bd
mov dword [ebp - 0x1724], 1
jmp 0x4848c4
and dword [ebp - 0x1724], 0
push 0
lea ecx, [ebp - 0x240c]
call fcn.00433c67
mov ecx, dword [ebp - 0x1724]
mov dword [eax], ecx
jmp 0x48480c
lea ecx, [ebp - 0x240c]
call fcn.00433c4b
push 5
push dword [ebp - 0x9f8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x138], 0x9e95d1c5
mov dword [ebp - 0x9b0], 0xffffffff
mov dword [ebp - 0x1ef4], 0
mov dword [ebp - 0x1f08], 4
mov dword [ebp - 0x2c98], 0xfffffff8
mov dword [ebp - 0x81c], 0
jmp 0x484942
mov eax, dword [ebp - 0x81c]
inc eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 3
jge 0x48495e
mov eax, dword [ebp - 0x81c]
mov dword [ebp + eax*4 - 0x3388], 0x47d17017
jmp 0x484935
cmp dword [ebp - 0x138], 0x964a
jne 0x484976
mov dword [ebp - 0x172c], 1
jmp 0x48497d
and dword [ebp - 0x172c], 0
mov eax, dword [ebp - 0x172c]
sub eax, 0xfff7
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x1ef4]
cmp dword [ebp - 0x9b0], eax
jge 0x4849af
push 4
pop eax
test eax, eax
je 0x4849af
mov dword [ebp - 0x1734], 1
jmp 0x4849b6
and dword [ebp - 0x1734], 0
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x1734]
cmp eax, dword [ebp - 0x138]
jg 0x4849dc
cmp dword [ebp - 0x138], 0
jne 0x4849dc
and dword [ebp - 0x173c], 0
jmp 0x4849e6
mov dword [ebp - 0x173c], 1
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x173c], eax
je 0x484a00
mov dword [ebp - 0x1744], 1
jmp 0x484a07
and dword [ebp - 0x1744], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x1744], eax
jl 0x484a21
mov dword [ebp - 0x1ef8], 1
jmp 0x484a28
and dword [ebp - 0x1ef8], 0
mov eax, 0x8df0
cmp eax, 0x2e11
jl 0x484a40
mov dword [ebp - 0x174c], 1
jmp 0x484a47
and dword [ebp - 0x174c], 0
cmp dword [ebp - 0x174c], 1
jg 0x484a5c
mov dword [ebp - 0x1754], 1
jmp 0x484a63
and dword [ebp - 0x1754], 0
cmp dword [ebp - 0x1754], 0xc3ad3b31
jae 0x484a7b
mov dword [ebp - 0x1f00], 1
jmp 0x484a82
and dword [ebp - 0x1f00], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x31a4], eax
mov eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x2ca0], eax
imul eax, dword [ebp - 0x1f08], 0x8433
mov dword [ebp - 0x138], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x138]
mov dword [ebp + eax - 0x3388], ecx
push 1
lea ecx, [ebp - 0xb04]
call fcn.00433b79
mov dword [ebp - 0x1f18], 0x1eca6c84
mov dword [ebp - 0x1f20], 0
mov dword [ebp - 0x54], 0
jmp 0x484aed
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x484b03
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x24cc], 1
jmp 0x484ae6
mov dword [ebp - 0x54], 0
jmp 0x484b13
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x484b2f
push dword [ebp - 0x54]
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov dword [eax], 0x6fe7d8a8
jmp 0x484b0c
mov dword [ebp - 0x54], 0
jmp 0x484b3f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x484b55
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x303c], 0xffffffff
jmp 0x484b38
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov dword [eax], 3
jmp 0x484b8e
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov dword [ebp - 0x175c], eax
mov eax, dword [ebp - 0x175c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x175c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
cmp dword [eax], 0
jl 0x484d04
mov dword [ebp - 0x9b8], 0xa0d018d3
mov dword [ebp - 0x1764], 0x83a0f0f5
mov byte [ebp - 0x25b], 0
movzx eax, byte [ebp - 0x25b]
test eax, eax
je 0x484bdb
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x24cc], 0xffffffff
jb 0x484cec
cmp dword [ebp - 0x9b8], 0xffffffff
je 0x484c0d
mov dword [ebp - 0x1f10], 1
jmp 0x484c14
and dword [ebp - 0x1f10], 0
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24cc]
mov dword [ebp - 0x2ca8], eax
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24cc]
mov dword [ebp - 0x1f18], eax
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24cc]
mov dword [ebp - 0x1764], eax
mov esi, dword [ebp - 0x9b8]
imul edi, dword [ebp - 0x1764], 0xe1f6
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x24cc]
imul eax, edi
cmp eax, esi
jge 0x484ca1
mov dword [ebp - 0x176c], 1
jmp 0x484ca8
and dword [ebp - 0x176c], 0
mov eax, dword [ebp - 0x176c]
imul eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x1774], eax
push 0
lea ecx, [ebp - 0xb04]
call fcn.00433c67
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1774]
mov dword [ebp + eax*4 - 0x24cc], ecx
cmp dword [ebp - 0x1774], 0
je 0x484cec
mov dword [ebp - 0x177c], 1
jmp 0x484cf3
and dword [ebp - 0x177c], 0
mov eax, dword [ebp - 0x177c]
mov dword [ebp - 0x1f20], eax
jmp 0x484b6a
lea ecx, [ebp - 0xb04]
call fcn.00433c4b
mov dword [ebp - 0x824], 0x4a8c6a53
mov dword [ebp - 0x3298], 0xffffffff
mov dword [ebp - 0x824], 0
jmp 0x484d3c
mov eax, dword [ebp - 0x824]
dec eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0xffffffe2
jle 0x484d78
mov dword [ebp - 0x1784], 0xfffffffc
mov byte [ebp - 0x309], 0
movzx eax, byte [ebp - 0x309]
test eax, eax
je 0x484d69
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov eax, dword [ebp - 0x1784]
dec eax
mov dword [ebp - 0x1784], eax
jmp 0x484d2f
push dword [ebp - 0x9f8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x20], 0x304b25b3
mov dword [ebp - 0x140], 0xbb2c593c
mov dword [ebp - 0x24ac], 1
mov dword [ebp - 0x24a8], 1
mov dword [ebp - 0x24a4], 1
mov dword [ebp - 0x24a0], 1
mov dword [ebp - 0x17e4], 0xe9d28bc1
mov dword [ebp - 0x17ec], 0xffffffff
mov dword [ebp - 0x5c], 0
jmp 0x484de1
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x484df7
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1e6c], 1
jmp 0x484dda
mov dword [ebp - 0x5c], 0
jmp 0x484e07
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x484e1d
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1f30], 0xfffffffd
jmp 0x484e00
mov dword [ebp - 0x5c], 0
jmp 0x484e2d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x484e43
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x34ec], 0x4462d17f
jmp 0x484e26
cmp dword [ebp - 0x20], 0
je 0x484e70
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2cb0], eax
cmp dword [ebp - 0x20], 0
jne 0x484e5c
cmp dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jge 0x484e70
mov dword [ebp - 0x1f28], 1
jmp 0x484e77
and dword [ebp - 0x1f28], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x304c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x178c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x178c]
mov dword [ebp + eax - 0x1e6c], ecx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x178c]
jge 0x484eb3
mov dword [ebp - 0x1794], 1
jmp 0x484eba
and dword [ebp - 0x1794], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1794], eax
je 0x484ed1
mov dword [ebp - 0x179c], 1
jmp 0x484ed8
and dword [ebp - 0x179c], 0
cmp dword [ebp - 0x179c], 0xc8490231
jae 0x484ef0
mov dword [ebp - 0x17a4], 1
jmp 0x484ef7
and dword [ebp - 0x17a4], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x17a4]
jle 0x484f0e
mov dword [ebp - 0x17ac], 1
jmp 0x484f15
and dword [ebp - 0x17ac], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x17ac], eax
je 0x484f2c
mov dword [ebp - 0x17b4], 1
jmp 0x484f33
and dword [ebp - 0x17b4], 0
cmp dword [ebp - 0x17b4], 0xa0f0f5eb
jne 0x484f4b
mov dword [ebp - 0x17bc], 1
jmp 0x484f52
and dword [ebp - 0x17bc], 0
mov eax, dword [ebp - 0x17bc]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x20], 0
jmp 0x484f6e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x485258
mov dword [ebp - 0x181c], 0x2dd8
push 4
lea ecx, [ebp - 0x24e8]
call fcn.00433b79
mov dword [ebp - 0x1f38], 1
mov dword [ebp - 0x82c], 0
jmp 0x484fb2
mov eax, dword [ebp - 0x82c]
inc eax
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 4
jge 0x484fd4
push dword [ebp - 0x82c]
lea ecx, [ebp - 0x24e8]
call fcn.00433c67
mov dword [eax], 0x35a60c43
jmp 0x484fa5
mov dword [ebp - 0x140], 2
jmp 0x484fed
cmp dword [ebp - 0x140], 0
jl 0x485248
mov eax, dword [ebp - 0x181c]
mov dword [ebp - 0x2cb8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24ac]
dec eax
mov dword [ebp - 0x17c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17c4]
mov dword [ebp + eax - 0x24ac], ecx
push 2
lea ecx, [ebp - 0x24e8]
call fcn.00433c67
mov ecx, dword [ebp - 0x17c4]
mov dword [eax], ecx
cmp dword [ebp - 0x140], 0
jne 0x48505b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e6c], 0
jne 0x485076
push 2
lea ecx, [ebp - 0x24e8]
call fcn.00433c67
cmp dword [eax], 0
jne 0x485076
and dword [ebp - 0x17cc], 0
jmp 0x485080
mov dword [ebp - 0x17cc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24ac]
cmp eax, dword [ebp - 0x17cc]
je 0x4850a1
mov dword [ebp - 0x17d4], 1
jmp 0x4850a8
and dword [ebp - 0x17d4], 0
cmp dword [ebp - 0x17d4], 1
jae 0x4850bd
mov dword [ebp - 0x9c0], 1
jmp 0x4850c4
and dword [ebp - 0x9c0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9c0]
mov dword [ebp + eax - 0x1f30], ecx
cmp dword [ebp - 0x9c0], 0
je 0x4850f5
mov eax, 0x5d57d38c
test eax, eax
je 0x4850f5
mov dword [ebp - 0x17dc], 1
jmp 0x4850fc
and dword [ebp - 0x17dc], 0
mov eax, dword [ebp - 0x17dc]
mov dword [ebp - 0x17e4], eax
mov eax, dword [ebp - 0x17e4]
mov dword [ebp - 0x17ec], eax
cmp dword [ebp - 0x17ec], 0xaf833954
jb 0x48512c
mov dword [ebp - 0x17f4], 1
jmp 0x485133
and dword [ebp - 0x17f4], 0
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x17f4]
jl 0x48514d
mov dword [ebp - 0x17fc], 1
jmp 0x485154
and dword [ebp - 0x17fc], 0
mov eax, dword [ebp - 0x17fc]
sub eax, 0xfffb
je 0x48517a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1e6c], 0
je 0x48517a
mov dword [ebp - 0x1804], 1
jmp 0x485181
and dword [ebp - 0x1804], 0
cmp dword [ebp - 0x1804], 4
jg 0x485196
mov dword [ebp - 0x180c], 1
jmp 0x48519d
and dword [ebp - 0x180c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1e6c]
imul eax, dword [ebp - 0x180c]
cmp eax, dword [ebp - 0x20]
je 0x4851bf
mov dword [ebp - 0x1814], 1
jmp 0x4851c6
and dword [ebp - 0x1814], 0
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp + eax*4 - 0x1e6c]
cmp dword [ebp - 0x1814], eax
jge 0x4851e7
mov dword [ebp - 0x1824], 1
jmp 0x4851ee
and dword [ebp - 0x1824], 0
mov eax, dword [ebp - 0x181c]
cmp dword [ebp - 0x1824], eax
je 0x485208
lea ecx, [ebp - 0x24e8]
call fcn.00433c4b
jmp 0x484f67
mov dword [ebp - 4], 0xcaf14c90
push 3
lea ecx, [ebp - 0x241c]
call fcn.00433b79
push 2
lea ecx, [ebp - 0xb4c]
call fcn.00433b79
mov dword [ebp - 0x4f4], 0xc23782e
mov dword [ebp - 0x9d0], 0xffffffff
mov dword [ebp - 0x1894], 0xffffffff
mov dword [ebp - 0x1f50], 0x4ffad677
mov dword [ebp - 0x148], 0
jmp 0x4852ba
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x4852d9
push dword [ebp - 0x148]
lea ecx, [ebp - 0x241c]
call fcn.00433c67
and dword [eax], 0
jmp 0x4852ad
mov dword [ebp - 0x148], 0
jmp 0x4852f2
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x485314
push dword [ebp - 0x148]
lea ecx, [ebp - 0xb4c]
call fcn.00433c67
mov dword [eax], 0x9209a488
jmp 0x4852e5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x31b8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2cc0], eax
cmp dword [ebp - 4], 0x7736
jle 0x48533b
mov dword [ebp - 0x183c], 1
jmp 0x485342
and dword [ebp - 0x183c], 0
imul eax, dword [ebp - 0x183c], 0x3eef
cmp eax, dword [ebp - 4]
jne 0x48535d
mov dword [ebp - 0x1844], 1
jmp 0x485364
and dword [ebp - 0x1844], 0
mov eax, dword [ebp - 0x1844]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jle 0x48537e
mov dword [ebp - 0x184c], 1
jmp 0x485385
and dword [ebp - 0x184c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x184c], eax
jle 0x4853a5
mov eax, 0xbc43cc9f
test eax, eax
je 0x4853a5
mov dword [ebp - 0x1854], 1
jmp 0x4853ac
and dword [ebp - 0x1854], 0
cmp dword [ebp - 0x1854], 0xe6c8cac3
jbe 0x4853c4
mov dword [ebp - 0x185c], 1
jmp 0x4853cb
and dword [ebp - 0x185c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x185c], eax
je 0x4853e2
mov dword [ebp - 0x1864], 1
jmp 0x4853e9
and dword [ebp - 0x1864], 0
push 0
lea ecx, [ebp - 0x241c]
call fcn.00433c67
mov ecx, dword [ebp - 0x1864]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
jl 0x485412
mov dword [ebp - 0x1f40], 1
jmp 0x485419
and dword [ebp - 0x1f40], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x305c], eax
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], eax
je 0x485436
mov dword [ebp - 0x186c], 1
jmp 0x48543d
and dword [ebp - 0x186c], 0
push 1
lea ecx, [ebp - 0xb4c]
call fcn.00433c67
mov ecx, dword [ebp - 0x186c]
mov dword [eax], ecx
mov esi, dword [ebp - 4]
push 0
lea ecx, [ebp - 0xb4c]
call fcn.00433c67
mov eax, dword [eax]
sub eax, dword [ebp - 4]
sub esi, eax
cmp esi, dword [ebp - 4]
jl 0x48547a
mov dword [ebp - 0x1874], 1
jmp 0x485481
and dword [ebp - 0x1874], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1874], eax
jne 0x485498
mov dword [ebp - 0x187c], 1
jmp 0x48549f
and dword [ebp - 0x187c], 0
mov eax, dword [ebp - 0x187c]
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0
jne 0x4854c3
cmp dword [ebp - 4], 0
jne 0x4854c3
mov dword [ebp - 0x1884], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x1884], eax
jl 0x4854e4
mov dword [ebp - 0x170], 0
jmp 0x486cb8
cmp dword [ebp - 0x170], 3
jge 0x486cd4
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x243c], 5
jmp 0x486cab
mov dword [ebp - 0x170], 0
jmp 0x486ced