Function at 0x470088
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get file size
Get file system object information
Get geographical location
Hide graphical window
Identify system language via api
Query environment variable
Read .ini file
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3704
call fcn.004a8800
push esi
push edi
mov dword [ebp - 0x94], 0xe0648261
mov dword [ebp - 0x6b0], 0x725245f5
mov dword [ebp - 0xaa0], 0x520c
mov dword [ebp - 0x1cc], 0
jmp 0x4700ce
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jge 0x4700ea
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xa98], 0xc6a3f0bd
jmp 0x4700c1
mov dword [ebp - 0x1cc], 0
jmp 0x470103
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x47011f
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x28f0], 0xd5ab883e
jmp 0x4700f6
mov dword [ebp - 0x94], 0xffffffef
jmp 0x470138
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xfffffffe
jge 0x4701a7
mov dword [ebp - 0x2018], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x329c], eax
mov eax, dword [ebp - 0x2018]
dec eax
cmp eax, dword [ebp - 0x94]
jl 0x470172
mov dword [ebp - 0x202c], 1
jmp 0x470179
and dword [ebp - 0x202c], 0
mov eax, dword [ebp - 0x202c]
mov dword [ebp - 0x2018], eax
mov byte [ebp - 0x3d3], 0
movzx eax, byte [ebp - 0x3d3]
test eax, eax
je 0x4701a5
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x47012b
mov dword [ebp - 0x94], 0xfffffffa
jmp 0x4701c0
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 8
jl 0x47045a
mov dword [ebp - 0x400], 0x167d
mov dword [ebp - 0x248c], 0xffffffff
cmp dword [ebp - 0x94], 0
jne 0x470415
cmp dword [ebp - 0x6b0], 0x40c88307
je 0x470206
mov dword [ebp - 0x2020], 1
jmp 0x47020d
and dword [ebp - 0x2020], 0
cmp dword [ebp - 0x2020], 2
jle 0x470222
mov dword [ebp - 0x2028], 1
jmp 0x470229
and dword [ebp - 0x2028], 0
cmp dword [ebp - 0x2028], 0x5c7d
jg 0x470241
mov dword [ebp - 0x2030], 1
jmp 0x470248
and dword [ebp - 0x2030], 0
cmp dword [ebp - 0x2030], 0xfffffff9
je 0x47025d
mov dword [ebp - 0x2038], 1
jmp 0x470264
and dword [ebp - 0x2038], 0
mov eax, dword [ebp - 0x2038]
add eax, 0x5e2ed85c
cmp eax, dword [ebp - 0x400]
jl 0x470283
mov dword [ebp - 0x2040], 1
jmp 0x47028a
and dword [ebp - 0x2040], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x2040], eax
jle 0x47029f
cmp dword [ebp - 0xaa0], 0
cmp dword [ebp - 0xaa0], 0
jne 0x4702b4
mov dword [ebp - 0x2238], 1
jmp 0x4702bb
and dword [ebp - 0x2238], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
mov dword [ebp - 0x2c18], eax
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0x2c20], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x2c28], eax
mov eax, dword [ebp - 0x94]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xa98]
cmp eax, 5
jne 0x470320
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28f0], 0
jne 0x470320
cmp dword [ebp - 0x400], 0
jne 0x470320
and dword [ebp - 0x2484], 0
jmp 0x47032a
mov dword [ebp - 0x2484], 1
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x2048], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2048]
mov dword [ebp + eax - 0x28f0], ecx
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x2048], eax
jle 0x470363
mov dword [ebp - 0x2050], 1
jmp 0x47036a
and dword [ebp - 0x2050], 0
mov eax, dword [ebp - 0x2050]
sub eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x2c30], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x2c38], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa98], 0x116104db
jle 0x4703b3
mov dword [ebp - 0x2058], 1
jmp 0x4703ba
and dword [ebp - 0x2058], 0
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x2058], eax
jle 0x4703d4
mov dword [ebp - 0x2098], 1
jmp 0x4703db
and dword [ebp - 0x2098], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa98]
cmp dword [ebp - 0x2098], eax
jle 0x4703fc
mov dword [ebp - 0x20a0], 1
jmp 0x470403
and dword [ebp - 0x20a0], 0
cmp dword [ebp - 0x20a0], 0xfffffffb
jl 0x470415
and dword [ebp - 0x20a8], 0
jmp 0x47041f
mov dword [ebp - 0x20a8], 1
mov eax, dword [ebp - 0xaa0]
cmp dword [ebp - 0x20a8], eax
jg 0x47043f
cmp dword [ebp - 0x6b0], 0
jne 0x47043f
and dword [ebp - 0x20b0], 0
jmp 0x470449
mov dword [ebp - 0x20b0], 1
mov eax, dword [ebp - 0x20b0]
mov dword [ebp - 0x248c], eax
jmp 0x4701b3
mov dword [ebp - 0x2c40], 0xeac8b13e
mov byte [ebp - 0x2c7], 0
movzx eax, byte [ebp - 0x2c7]
test eax, eax
je 0x470489
push 0
push 0
push 0x231f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x2c9], 0
movzx eax, byte [ebp - 0x2c9]
test eax, eax
je 0x4704b1
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [ebp - 0x2b0], 1
mov dword [ebp - 0x1ba8], 0xfffffffb
mov dword [ebp - 0x1bc0], 0x32987c83
mov dword [ebp - 0xaa8], 0
jmp 0x4704e8
mov eax, dword [ebp - 0xaa8]
inc eax
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xaa8], 3
jge 0x470504
mov eax, dword [ebp - 0xaa8]
mov dword [ebp + eax*4 - 0x3428], 0xffffffff
jmp 0x4704db
mov byte [ebp - 0x2cb], 0
movzx eax, byte [ebp - 0x2cb]
test eax, eax
je 0x470527
push 0xdcc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [ebp - 0x2b0], 0
jmp 0x470540
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 7
jle 0x470830
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x2130], 0xb0420410
mov dword [ebp - 0x6b8], 0xdc14c38d
mov dword [ebp - 0xab8], 0x8a87ea82
mov dword [ebp - 0x1bb0], 0x1359
mov dword [ebp - 0xab0], 0
jmp 0x470598
mov eax, dword [ebp - 0xab0]
inc eax
mov dword [ebp - 0xab0], eax
cmp dword [ebp - 0xab0], 2
jge 0x4705b4
mov eax, dword [ebp - 0xab0]
mov dword [ebp + eax*4 - 0x2db4], 1
jmp 0x47058b
cmp dword [ebp - 0x258], 0
jne 0x4705d4
cmp dword [ebp - 0x2b0], 0
jne 0x4705d4
cmp dword [ebp - 0x258], 0
jne 0x4705d4
or eax, 0xffffffff
je 0x4705e7
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x4705e7
mov dword [ebp - 0x20f8], 1
jmp 0x4705ee
and dword [ebp - 0x20f8], 0
cmp dword [ebp - 0x20f8], 0xee91b76
jne 0x470606
mov dword [ebp - 0x2100], 1
jmp 0x47060d
and dword [ebp - 0x2100], 0
cmp dword [ebp - 0x2100], 0xc9bf
jle 0x470625
mov dword [ebp - 0x2108], 1
jmp 0x47062c
and dword [ebp - 0x2108], 0
mov eax, dword [ebp - 0x2108]
neg eax
cmp dword [ebp - 0x258], eax
jge 0x470648
mov dword [ebp - 0xbd0], 1
jmp 0x47064f
and dword [ebp - 0xbd0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbd0]
mov dword [ebp + eax - 0x3428], ecx
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x2130], eax
mov eax, dword [ebp - 0x258]
sub eax, dword [ebp - 0x2130]
mov ecx, dword [ebp - 0x258]
imul ecx, eax
cmp ecx, dword [ebp - 0x258]
jle 0x470697
mov dword [ebp - 0x2138], 1
jmp 0x47069e
and dword [ebp - 0x2138], 0
cmp dword [ebp - 0x2138], 0x5751
jle 0x4706b6
mov dword [ebp - 0x211c], 1
jmp 0x4706bd
and dword [ebp - 0x211c], 0
mov eax, dword [ebp - 0x211c]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
imul eax, dword [ebp - 0x6b8]
cmp eax, dword [ebp - 0x6b8]
jge 0x4706ea
mov dword [ebp - 0xc98], 1
jmp 0x4706f1
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0x6b8]
cmp dword [ebp - 0xc98], eax
jge 0x47070b
mov dword [ebp - 0x1ba0], 1
jmp 0x470712
and dword [ebp - 0x1ba0], 0
mov eax, dword [ebp - 0x1ba0]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0xab8]
cmp dword [ebp - 0x6b8], eax
jge 0x470738
mov dword [ebp - 0xca0], 1
jmp 0x47073f
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x1ba8], eax
mov eax, dword [ebp - 0x1bb0]
cmp dword [ebp - 0x1ba8], eax
je 0x470765
mov dword [ebp - 0xca8], 1
jmp 0x47076c
and dword [ebp - 0xca8], 0
cmp dword [ebp - 0xca8], 1
je 0x470781
mov dword [ebp - 0x2494], 1
jmp 0x470788
and dword [ebp - 0x2494], 0
mov eax, dword [ebp - 0x1bb0]
mov dword [ebp - 0x2c48], eax
cmp dword [ebp - 0x2b0], 0x3988
jne 0x4707ac
mov dword [ebp - 0xcb0], 1
jmp 0x4707b3
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0xab8]
cmp dword [ebp - 0xcb0], eax
jg 0x4707dd
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2db4], 0
je 0x4707dd
mov dword [ebp - 0x1bb8], 1
jmp 0x4707e4
and dword [ebp - 0x1bb8], 0
mov eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0x1bb8]
imul eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x2b0]
jne 0x47080c
mov dword [ebp - 0xcb8], 1
jmp 0x470813
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0x1bc0], eax
mov eax, dword [ebp - 0x1bc0]
mov dword [ebp - 0xab8], eax
jmp 0x470533
mov dword [ebp - 0xa4], 0xe0648261
mov dword [ebp - 0x514], 4
mov dword [ebp - 0x2c50], 0x3e58bfc4
mov dword [ebp - 0x2c58], 0x703d9b95
mov dword [ebp - 0xbe8], 0x2daab72b
mov dword [ebp - 0xce0], 0
mov dword [ebp - 0x2c60], 0xffffffff
mov dword [ebp - 0x2c68], 0xfffffffc
mov dword [ebp - 0x24a4], 0
mov dword [ebp - 0xcd0], 0x34174aa7
mov dword [ebp - 0xbd8], 0xfff7
mov dword [ebp - 0x64], 0
jmp 0x4708ae
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x4708c4
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x29a4], 0
jmp 0x4708a7
mov dword [ebp - 0x64], 0
jmp 0x4708d4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x4708ea
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x29d4], 0x39ecf4a4
jmp 0x4708cd
mov dword [ebp - 0x64], 0
jmp 0x4708fa
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x470910
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x249c], 0x491d0b6b
jmp 0x4708f3
mov dword [ebp - 0x514], 0
jmp 0x470929
mov eax, dword [ebp - 0x514]
inc eax
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 3
jge 0x470945
mov eax, dword [ebp - 0x514]
mov dword [ebp + eax*4 - 0x29a4], 0xb4ffb87
jmp 0x47091c
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x2c70], eax
mov eax, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xbd8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x29d4], 0xcd3c
jg 0x470991
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x249c], 0xfff8
test eax, eax
je 0x470991
mov dword [ebp - 0xcc0], 1
jmp 0x470998
and dword [ebp - 0xcc0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29d4]
imul eax, dword [ebp - 0xcc0]
cmp eax, 1
je 0x4709c6
cmp dword [ebp - 0xbe8], 0
je 0x4709c6
mov dword [ebp - 0xbe0], 1
jmp 0x4709cd
and dword [ebp - 0xbe0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbe0]
mov dword [ebp + eax - 0x29d4], ecx
mov eax, dword [ebp - 0x24a4]
cmp dword [ebp - 0xbe0], eax
jl 0x4709fa
mov dword [ebp - 0x1bc8], 1
jmp 0x470a01
and dword [ebp - 0x1bc8], 0
cmp dword [ebp - 0x1bc8], 0xffffffff
jl 0x470a1f
cmp dword [ebp - 0xbe8], 0
je 0x470a1f
mov dword [ebp - 0xcc8], 1
jmp 0x470a26
and dword [ebp - 0xcc8], 0
mov eax, dword [ebp - 0xcd0]
cmp dword [ebp - 0xcc8], eax
jl 0x470a40
mov dword [ebp - 0x1bd0], 1
jmp 0x470a47
and dword [ebp - 0x1bd0], 0
cmp dword [ebp - 0x1bd0], 0x986219e2
jae 0x470a5f
mov dword [ebp - 0x1bd8], 1
jmp 0x470a66
and dword [ebp - 0x1bd8], 0
mov eax, dword [ebp - 0xcd0]
imul eax, dword [ebp - 0x1bd8]
test eax, eax
jne 0x470a8f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x29a4], 0
jne 0x470a8f
and dword [ebp - 0xcd8], 0
jmp 0x470a99
mov dword [ebp - 0xcd8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29a4]
cmp eax, dword [ebp - 0xcd8]
jge 0x470aba
mov dword [ebp - 0x1be0], 1
jmp 0x470ac1
and dword [ebp - 0x1be0], 0
mov eax, dword [ebp - 0x1be0]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0xce0]
sub eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x54c], 0x725245f5
mov dword [ebp - 0x6c0], 0xffffffff
mov dword [ebp - 0x4d4], 0x3c4ab274
mov dword [ebp - 0x2a04], 0xfffffffd
mov dword [ebp - 0x2a00], 0xfffffffd
mov dword [ebp - 0x29fc], 0xfffffffd
mov dword [ebp - 0x29f8], 0xfffffffd
mov dword [ebp - 0xcf0], 5
mov dword [ebp - 0x24ac], 0xc039ecf4
mov eax, dword [ebp - 0x6c0]
cmp dword [ebp - 0x6c0], eax
jle 0x470b53
mov dword [ebp - 0x1be8], 1
jmp 0x470b5a
and dword [ebp - 0x1be8], 0
mov eax, dword [ebp - 0x1be8]
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0xbf0b
jl 0x470b7e
mov dword [ebp - 0xce8], 1
jmp 0x470b85
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x2c78], eax
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x2c80], eax
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x1bf0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1bf0]
mov dword [ebp + eax - 0x2a04], ecx
mov eax, dword [ebp - 0xce8]
imul eax, dword [ebp - 0x1bf0]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x24ac], eax
mov dword [ebp - 0x4d4], 0x15
jmp 0x470bf4
mov eax, dword [ebp - 0x4d4]
dec eax
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0xfffffffd
jge 0x470c17
mov byte [ebp - 0x2cd], 0
movzx eax, byte [ebp - 0x2cd]
test eax, eax
je 0x470c15
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x470be7
mov dword [ebp - 0xabc], 0x520c
mov dword [ebp - 0x2c88], 0xeac8b13e
mov byte [ebp - 0x2cf], 0
movzx eax, byte [ebp - 0x2cf]
test eax, eax
je 0x470c50
push 0
push 0
push 0x231f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x2d1], 0
movzx eax, byte [ebp - 0x2d1]
test eax, eax
je 0x470c78
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [ebp - 0x6c8], 0x4a18885c
mov dword [ebp - 0xac0], 0
jmp 0x470c9b
mov eax, dword [ebp - 0xac0]
inc eax
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0xac0], 2
jge 0x470cb7
mov eax, dword [ebp - 0xac0]
mov dword [ebp + eax*4 - 0x262c], 0x9b3198a8
jmp 0x470c8e
mov dword [ebp - 0x6c8], 1
jmp 0x470cd0
mov eax, dword [ebp - 0x6c8]
dec eax
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 0
jl 0x470ee0
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x6a8], 1
jmp 0x470d00
mov eax, dword [ebp - 0x6a8]
dec eax
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0
jl 0x470edb
mov dword [ebp - 0x260], 0x3e9323d1
mov dword [ebp - 0x260], 1
jmp 0x470d30
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jl 0x470e1c
mov dword [ebp - 0xac8], 0xfffffff9
mov dword [ebp - 0xac8], 0
jmp 0x470d60
mov eax, dword [ebp - 0xac8]
inc eax
mov dword [ebp - 0xac8], eax
cmp dword [ebp - 0xac8], 1
jg 0x470e17
mov dword [ebp - 0x52c], 0xfffffffd
mov dword [ebp - 0x52c], 0
jmp 0x470d90
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 1
jg 0x470e12
mov dword [ebp - 0x6e8], 0xbb00868b
mov dword [ebp - 0x6e8], 0
jmp 0x470dbc
mov eax, dword [ebp - 0x6e8]
inc eax
mov dword [ebp - 0x6e8], eax
cmp dword [ebp - 0x6e8], 1
jg 0x470df3
mov byte [ebp - 0x2d3], 0
movzx eax, byte [ebp - 0x2d3]
test eax, eax
je 0x470ddf
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x6c8]
cmp dword [ebp + eax*4 - 0x262c], 0
je 0x470df1
jmp 0x470df3
jmp 0x470daf
mov eax, dword [ebp - 0x6a8]
mov ecx, dword [ebp - 0x52c]
mov eax, dword [ebp + eax*4 - 0x262c]
mov dword [ebp + ecx*4 - 0x262c], eax
jmp 0x470d83
jmp 0x470d53
jmp 0x470d23
mov dword [ebp - 0x260], 0
jmp 0x470e35
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jg 0x470ed6
mov dword [ebp - 0xa3c], 0
jmp 0x470e5b
mov eax, dword [ebp - 0xa3c]
inc eax
mov dword [ebp - 0xa3c], eax
cmp dword [ebp - 0xa3c], 3
jge 0x470e77
mov eax, dword [ebp - 0xa3c]
mov dword [ebp + eax*4 - 0x282c], 0xffffffff
jmp 0x470e4e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x282c], 0
jmp 0x470ea5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x282c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x282c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x282c], 1
jg 0x470ed1
mov byte [ebp - 0x2d5], 0
movzx eax, byte [ebp - 0x2d5]
test eax, eax
je 0x470ecf
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x470e8a
jmp 0x470e28
jmp 0x470cf3
jmp 0x470cc3
mov dword [ebp - 0x2c90], 0xfffffff6
mov byte [ebp - 0x2d7], 0
movzx eax, byte [ebp - 0x2d7]
test eax, eax
je 0x470f1c
push 0
push 0xdf3
push 0x6b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov byte [ebp - 0x2d9], 0
movzx eax, byte [ebp - 0x2d9]
test eax, eax
je 0x470f38
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov dword [ebp - 0x6f0], 0xcb13638e
mov dword [ebp - 0x2c98], 0x576c5165
mov dword [ebp - 0x2ca0], 0xec7516a2
mov dword [ebp - 0x2ca8], 1
mov dword [ebp - 0x2cb0], 0xbbd0a708
mov dword [ebp - 0x2cb8], 8
mov dword [ebp - 0x1bf8], 0
mov dword [ebp - 0x9c], 0
jmp 0x470f97
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x470fb3
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x3440], 0x3342eb90
jmp 0x470f8a
mov dword [ebp - 0x9c], 0
jmp 0x470fcc
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x470fe8
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x2cc0], 0xf29acd40
jmp 0x470fbf
mov dword [ebp - 0x9c], 0
jmp 0x471001
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x47101d
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x35f8], 0
jmp 0x470ff4
mov dword [ebp - 0x6f0], 2
jmp 0x471036
mov eax, dword [ebp - 0x6f0]
dec eax
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x6f0], 0
jl 0x47109b
mov dword [ebp - 0x994], 0xc4530722
mov dword [ebp - 0x994], 2
jmp 0x471062
mov eax, dword [ebp - 0x994]
dec eax
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x994], 0
jl 0x471087
mov byte [ebp - 0x2db], 0
movzx eax, byte [ebp - 0x2db]
test eax, eax
je 0x471085
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x471055
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3440], 0
je 0x471099
jmp 0x471029
jmp 0x471029
mov eax, dword [ebp - 0x1bf8]
dec eax
mov dword [ebp - 0x1bf8], eax
mov dword [ebp - 0x230], 0
jmp 0x4710c1
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x4710dd
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x738], 0xc6a3f0bd
jmp 0x4710b4
mov dword [ebp - 0x40c], 0x692b
mov dword [ebp - 0xc00], 0x46758e35
cmp dword [ebp - 0x40c], 0
je 0x471272
mov dword [ebp - 0x168], 0
jmp 0x471117
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x471133
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x3458], 0xffffffff
jmp 0x47110a
mov dword [ebp - 0x168], 0
jmp 0x47114c
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x471168
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0xbf0], 0xffffffff
jmp 0x47113f
mov dword [ebp - 0x40c], 0
jmp 0x471181
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x1c
jge 0x471270
mov dword [ebp - 0xbf8], 0xfffffff9
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x2cc8], eax
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0x2cd0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xbf0]
cmp dword [ebp + eax - 0xbf0], ecx
jle 0x4711d8
mov dword [ebp - 0xcf8], 1
jmp 0x4711df
and dword [ebp - 0xcf8], 0
mov eax, dword [ebp - 0xbf8]
cmp dword [ebp - 0xcf8], eax
jge 0x4711f9
mov dword [ebp - 0x24b4], 1
jmp 0x471200
and dword [ebp - 0x24b4], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3458], 0x3718
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbf0]
mov dword [ebp - 0x2cd8], eax
cmp dword [ebp - 0xbf8], 0xffffffff
jne 0x47124a
mov byte [ebp - 0x2dd], 0
movzx eax, byte [ebp - 0x2dd]
test eax, eax
je 0x471248
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x47126b
mov byte [ebp - 0x2df], 0
movzx eax, byte [ebp - 0x2df]
test eax, eax
je 0x47126b
push 0x1db2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x471174
jmp 0x47127c
mov dword [ebp - 0xc00], 0xffffffff
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xc00], eax
mov dword [ebp - 0x230], 0
jmp 0x4712a1
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x4712bd
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x2920], 0xd5ab883e
jmp 0x471294
mov dword [ebp - 0x53c], 0xfffffffc
mov dword [ebp - 0x6f8], 0
jmp 0x4712e0
mov eax, dword [ebp - 0x6f8]
inc eax
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 4
jge 0x4712fc
mov eax, dword [ebp - 0x6f8]
mov dword [ebp + eax*4 - 0x3384], 0x34504cd4
jmp 0x4712d3
mov byte [ebp - 0x2e1], 0
movzx eax, byte [ebp - 0x2e1]
test eax, eax
je 0x471316
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov dword [ebp - 0x53c], 0
jmp 0x47132f
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 3
jg 0x471443
mov dword [ebp - 0x604], 1
mov dword [ebp - 0x604], 0
jmp 0x47135f
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 3
jg 0x47143e
mov dword [ebp - 0xacc], 0
jmp 0x471385
mov eax, dword [ebp - 0xacc]
inc eax
mov dword [ebp - 0xacc], eax
cmp dword [ebp - 0xacc], 2
jge 0x4713a1
mov eax, dword [ebp - 0xacc]
mov dword [ebp + eax*4 - 0x21b4], 0xd2e8588d
jmp 0x471378
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x21b4], 0
jmp 0x4713cf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21b4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x21b4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21b4], 3
jg 0x47141f
mov byte [ebp - 0x2e3], 0
movzx eax, byte [ebp - 0x2e3]
test eax, eax
je 0x471403
push 0x12c2
push 0
push 0xb4c
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x604]
mov ecx, dword [ebp - 0x53c]
mov eax, dword [ebp + eax*4 - 0x3384]
mov dword [ebp + ecx*4 - 0x3384], eax
jmp 0x4713b4
mov byte [ebp - 0x2e5], 0
movzx eax, byte [ebp - 0x2e5]
test eax, eax
je 0x471439
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x471352
jmp 0x471322
mov dword [ebp - 0xa4], 0xffffffef
jmp 0x47145c
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffffe
jge 0x472009
mov dword [ebp - 0x99c], 9
mov dword [ebp - 0x2ce0], 0x5af8b513
mov dword [ebp - 0x24bc], 0xbea5223f
mov dword [ebp - 0x2ce8], 0xffffffff
mov dword [ebp - 0x2cf0], 0xb3a00d0e
mov dword [ebp - 0x2cf8], 4
mov dword [ebp - 0x1c00], 1
mov dword [ebp - 0x700], 0
jmp 0x4714c8
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 3
jge 0x4714e4
mov eax, dword [ebp - 0x700]
mov dword [ebp + eax*4 - 0x358c], 0xffffffff
jmp 0x4714bb
mov dword [ebp - 0x99c], 0
jmp 0x4714fd
mov eax, dword [ebp - 0x99c]
inc eax
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x99c], 5
jne 0x471660
mov dword [ebp - 0x170], 0
jmp 0x471523
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x47153f
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x3470], 0
jmp 0x471516
mov dword [ebp - 0x170], 0
jmp 0x471558
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x471574
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x26e4], 0
jmp 0x47154b
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x26e4], 0
jmp 0x47159f
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x26e4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x26e4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x26e4], 2
jg 0x47165b
mov dword [ebp - 0x708], 1
mov dword [ebp - 0x2d00], 0x2ca8cda2
mov dword [ebp - 0x708], 0
jmp 0x4715df
mov eax, dword [ebp - 0x708]
inc eax
mov dword [ebp - 0x708], eax
cmp dword [ebp - 0x708], 2
jg 0x471656
mov dword [ebp - 0xa44], 0
jmp 0x471601
mov eax, dword [ebp - 0xa44]
inc eax
mov dword [ebp - 0xa44], eax
cmp dword [ebp - 0xa44], 2
jge 0x47161d
mov eax, dword [ebp - 0xa44]
mov dword [ebp + eax*4 - 0x2950], 0
jmp 0x4715f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2950]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2950], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x26e4]
mov eax, dword [ebp + eax*4 - 0x3470]
mov dword [ebp - 0x24bc], eax
jmp 0x4715d2
jmp 0x471586
jmp 0x4714f0
mov eax, dword [ebp - 0x1c00]
inc eax
mov dword [ebp - 0x1c00], eax
mov dword [ebp - 0xd20], 0
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x66c], 0x2466e9f0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2d08], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
jle 0x4716a5
mov dword [ebp - 0xd00], 1
jmp 0x4716ac
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0xd00], eax
je 0x4716c3
mov dword [ebp - 0x1c08], 1
jmp 0x4716ca
and dword [ebp - 0x1c08], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1c08], eax
jl 0x4716e1
mov dword [ebp - 0xd08], 1
jmp 0x4716e8
and dword [ebp - 0xd08], 0
cmp dword [ebp - 0xd08], 0
jne 0x471700
cmp dword [ebp - 0x6c], 0
jne 0x471700
mov eax, 0x6fd4
test eax, eax
je 0x471715
cmp dword [ebp - 0x66c], 0
je 0x471715
mov dword [ebp - 0x1c10], 1
jmp 0x47171c
and dword [ebp - 0x1c10], 0
mov eax, dword [ebp - 0x1c10]
sub eax, dword [ebp - 0x66c]
jne 0x471731
cmp dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
cmp dword [ebp - 0x6c], eax
jge 0x471748
mov dword [ebp - 0xd10], 1
jmp 0x47174f
and dword [ebp - 0xd10], 0
cmp dword [ebp - 0xd10], 0
jae 0x471764
mov dword [ebp - 0x1c18], 1
jmp 0x47176b
and dword [ebp - 0x1c18], 0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x1c18]
sub eax, ecx
je 0x471790
cmp dword [ebp - 0x66c], 0
je 0x471790
mov dword [ebp - 0xd18], 1
jmp 0x471797
and dword [ebp - 0xd18], 0
mov eax, dword [ebp - 0xd18]
sub eax, 0x580b15ec
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
jmp 0x4717b5
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x18
jge 0x4717d9
mov byte [ebp - 0x2e7], 0
movzx eax, byte [ebp - 0x2e7]
test eax, eax
je 0x4717d7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x4717ae
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x2d10], eax
mov eax, dword [ebp - 0xd20]
dec eax
cmp eax, dword [ebp - 0xa4]
jl 0x471800
mov dword [ebp - 0x1c20], 1
jmp 0x471807
and dword [ebp - 0x1c20], 0
mov eax, dword [ebp - 0x1c20]
mov dword [ebp - 0xd20], eax
mov dword [ebp - 0x44], 0x69ad
mov dword [ebp - 0x1c50], 6
mov dword [ebp - 0x24cc], 0xffffffff
mov dword [ebp - 0x710], 0
jmp 0x471847
mov eax, dword [ebp - 0x710]
inc eax
mov dword [ebp - 0x710], eax
cmp dword [ebp - 0x710], 2
jge 0x471863
mov eax, dword [ebp - 0x710]
mov dword [ebp + eax*4 - 0x20bc], 0xccb090ae
jmp 0x47183a
mov byte [ebp - 0x2e9], 0
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x47187d
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
cmp dword [ebp - 0x44], 0
jne 0x471ad1
mov dword [ebp - 0xc08], 0xfffffffa
mov dword [ebp - 0x1c48], 0xffffffff
mov dword [ebp - 0x9a4], 0
jmp 0x4718b4
mov eax, dword [ebp - 0x9a4]
inc eax
mov dword [ebp - 0x9a4], eax
cmp dword [ebp - 0x9a4], 2
jge 0x4718d0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp + eax*4 - 0x2dc0], 0x5e17ca00
jmp 0x4718a7
mov dword [ebp - 0x44], 1
jmp 0x4718e0
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x47193a
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x718], 1
jmp 0x471909
mov eax, dword [ebp - 0x718]
dec eax
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x718], 0
jl 0x471938
mov byte [ebp - 0x2eb], 0
movzx eax, byte [ebp - 0x2eb]
test eax, eax
je 0x471936
push 0x283
push 0x5ee
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x4718fc
jmp 0x4718d9
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2d18], eax
xor eax, eax
jne 0x4719d6
cmp dword [ebp - 0x44], 0
jne 0x471963
cmp dword [ebp - 0x1c50], 0
jne 0x471963
and dword [ebp - 0x1c28], 0
jmp 0x47196d
mov dword [ebp - 0x1c28], 1
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x1c28]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xc08], eax
jge 0x471998
push 9
pop eax
test eax, eax
jne 0x471998
and dword [ebp - 0xd28], 0
jmp 0x4719a2
mov dword [ebp - 0xd28], 1
cmp dword [ebp - 0xd28], 0xffff
jae 0x4719ba
mov dword [ebp - 0x1c30], 1
jmp 0x4719c1
and dword [ebp - 0x1c30], 0
cmp dword [ebp - 0x1c30], 0x886a6c65
jae 0x4719d6
and dword [ebp - 0xd30], 0
jmp 0x4719e0
mov dword [ebp - 0xd30], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2dc0]
cmp dword [ebp - 0xd30], eax
je 0x471a01
mov dword [ebp - 0x1c38], 1
jmp 0x471a08
and dword [ebp - 0x1c38], 0
cmp dword [ebp - 0x1c38], 0x8729
jne 0x471a20
mov dword [ebp - 0xd38], 1
jmp 0x471a27
and dword [ebp - 0xd38], 0
cmp dword [ebp - 0xd38], 0xfffffff8
jbe 0x471a42
cmp dword [ebp - 0xc08], 0
jne 0x471a42
and dword [ebp - 0x1c40], 0
jmp 0x471a4c
mov dword [ebp - 0x1c40], 1
cmp dword [ebp - 0x1c40], 0xffff
jae 0x471a64
mov dword [ebp - 0x24c4], 1
jmp 0x471a6b
and dword [ebp - 0x24c4], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2d20], eax
xor eax, eax
inc eax
je 0x471a8e
cmp dword [ebp - 0x1c48], 0
je 0x471a8e
mov dword [ebp - 0xd40], 1
jmp 0x471a95
and dword [ebp - 0xd40], 0
mov eax, dword [ebp - 0xd40]
sub eax, dword [ebp - 0x1c48]
imul eax, eax, 0xffff
mov dword [ebp - 0xd48], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd48]
mov dword [ebp + eax - 0x20bc], ecx
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0x24cc], eax
jmp 0x471d02
mov dword [ebp - 0xa94], 0
jmp 0x471aea
mov eax, dword [ebp - 0xa94]
inc eax
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 3
jge 0x471b06
mov eax, dword [ebp - 0xa94]
mov dword [ebp + eax*4 - 0x21f4], 0x36042c8c
jmp 0x471add
mov dword [ebp - 0x44], 0xfffffff2
jmp 0x471b16
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x15
jge 0x471d02
mov dword [ebp - 0x1c60], 0x55584e2b
mov byte [ebp - 0x2ed], 0
movzx eax, byte [ebp - 0x2ed]
test eax, eax
je 0x471b71
push 0x14c2
push 0x313
push 0x94f
push 0x175b
push 0x1665
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
cmp dword [ebp - 0x1c60], 0xffffffff
jne 0x471b92
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x21f4], 0
jne 0x471b92
and dword [ebp - 0xd50], 0
jmp 0x471b9c
mov dword [ebp - 0xd50], 1
mov eax, dword [ebp - 0x1c50]
add eax, dword [ebp - 0xd50]
jns 0x471bb6
mov dword [ebp - 0x1c58], 1
jmp 0x471bbd
and dword [ebp - 0x1c58], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
add eax, dword [ebp - 0x1c58]
je 0x471be1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20bc], 0
jne 0x471bfa
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x20bc], 0
jne 0x471bfa
and dword [ebp - 0xd58], 0
jmp 0x471c04
mov dword [ebp - 0xd58], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
add eax, dword [ebp - 0xd58]
cmp dword [ebp - 0x44], eax
jle 0x471c29
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20bc], 0
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x471c45
cmp dword [ebp - 0x1c60], 0
je 0x471c45
mov dword [ebp - 0xd60], 1
jmp 0x471c4c
and dword [ebp - 0xd60], 0
cmp dword [ebp - 0xd60], 0xd4b3bebd
jbe 0x471c64
mov dword [ebp - 0x1c68], 1
jmp 0x471c6b
and dword [ebp - 0x1c68], 0
mov eax, dword [ebp - 0x1c68]
sub eax, 3
cmp eax, 0x58af3265
jne 0x471c87
mov dword [ebp - 0xd68], 1
jmp 0x471c8e
and dword [ebp - 0xd68], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
imul eax, dword [ebp - 0xd68]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x21f4]
je 0x471cbc
mov dword [ebp - 0x1c70], 1
jmp 0x471cc3
and dword [ebp - 0x1c70], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21f4]
cmp dword [ebp - 0x1c70], eax
jne 0x471ce3
mov dword [ebp - 0xd70], 1
jmp 0x471cea
and dword [ebp - 0xd70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd70]
mov dword [ebp + eax - 0x20bc], ecx
jmp 0x471b0f
mov dword [ebp - 0x24d4], 0xfffffffd
mov dword [ebp - 0x1e0], 0
jmp 0x471d25
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x471d41
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xae4], 9
jmp 0x471d18
mov dword [ebp - 0x1e0], 0
jmp 0x471d5a
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x471d76
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x3488], 0xe22401db
jmp 0x471d4d
mov byte [ebp - 0x2ef], 0
movzx eax, byte [ebp - 0x2ef]
test eax, eax
je 0x471d95
push 0x12e5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xae4], 0
je 0x471dc0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae4], 0
je 0x471dc0
mov dword [ebp - 0x1c78], 1
jmp 0x471dc7
and dword [ebp - 0x1c78], 0
cmp dword [ebp - 0x1c78], 0xa17d0b0a
jae 0x471ddf
mov dword [ebp - 0xd78], 1
jmp 0x471de6
and dword [ebp - 0xd78], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xae4]
cmp eax, dword [ebp - 0xd78]
jge 0x471e06
mov dword [ebp - 0x1c80], 1
jmp 0x471e0d
and dword [ebp - 0x1c80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
imul eax, dword [ebp - 0x1c80]
test eax, eax
je 0x471e33
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xae4], 2
je 0x471e4f
mov dword [ebp - 0xd80], 1
jmp 0x471e56
and dword [ebp - 0xd80], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd80]
neg ecx
cmp dword [ebp + eax - 0xae4], ecx
jg 0x471e79
mov dword [ebp - 0x1c88], 1
jmp 0x471e80
and dword [ebp - 0x1c88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
add eax, dword [ebp - 0x1c88]
cmp eax, 0xf144
jg 0x471ea6
mov dword [ebp - 0xd88], 1
jmp 0x471ead
and dword [ebp - 0xd88], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
imul eax, dword [ebp - 0xd88]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xae4]
jg 0x471edc
mov dword [ebp - 0x1c90], 1
jmp 0x471ee3
and dword [ebp - 0x1c90], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c90]
mov dword [ebp + eax - 0x3488], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xae4]
mov dword [ebp - 0x2d28], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xae4]
cmp dword [ebp + eax - 0xae4], ecx
jne 0x471f30
mov dword [ebp - 0xd90], 1
jmp 0x471f37
and dword [ebp - 0xd90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xae4]
imul eax, dword [ebp - 0xd90]
test eax, eax
jl 0x471f5b
mov dword [ebp - 0x1c98], 1
jmp 0x471f62
and dword [ebp - 0x1c98], 0
cmp dword [ebp - 0x1c98], 0xdfe9
je 0x471f7a
mov dword [ebp - 0xd98], 1
jmp 0x471f81
and dword [ebp - 0xd98], 0
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0x24d4], eax
mov byte [ebp - 0x2f5], 0
mov dword [ebp - 0x2d30], 0xeac8b13e
mov byte [ebp - 0x2f1], 0
movzx eax, byte [ebp - 0x2f1]
test eax, eax
je 0x471fc3
push 0
push 0
push 0x231f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x2f3], 0
movzx eax, byte [ebp - 0x2f3]
test eax, eax
je 0x471feb
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
movzx eax, byte [ebp - 0x2f5]
test eax, eax
je 0x472004
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x47144f
mov dword [ebp - 0x544], 0xc184c506
mov dword [ebp - 0x2d38], 0xfff7
mov dword [ebp - 0x720], 0
jmp 0x472036
mov eax, dword [ebp - 0x720]
inc eax
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 2
jge 0x472052
mov eax, dword [ebp - 0x720]
mov dword [ebp + eax*4 - 0x2dcc], 0xffffffff
jmp 0x472029
mov dword [ebp - 0x544], 0
jmp 0x47206b
mov eax, dword [ebp - 0x544]
inc eax
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 1
jg 0x472088
mov eax, dword [ebp - 0x544]
cmp dword [ebp + eax*4 - 0x2dcc], 0
je 0x472086
jmp 0x472088
jmp 0x47205e
mov dword [ebp - 0xa4], 0xfffffffa
jmp 0x4720a1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 8
jl 0x472bcb
mov dword [ebp - 0x1cb0], 0xffffffff
mov dword [ebp - 0x1cc8], 0xf4f4
mov dword [ebp - 0xdd0], 0x2061f665
mov dword [ebp - 0x494], 0x58bac04e
mov dword [ebp - 0x24dc], 0x5b40194d
mov dword [ebp - 0x728], 0x2aee5a98
mov dword [ebp - 0x2d40], 0xa53e
mov dword [ebp - 0x9ac], 0
jmp 0x47210d
mov eax, dword [ebp - 0x9ac]
inc eax
mov dword [ebp - 0x9ac], eax
cmp dword [ebp - 0x9ac], 3
jge 0x472129
mov eax, dword [ebp - 0x9ac]
mov dword [ebp + eax*4 - 0x28a4], 4
jmp 0x472100
mov eax, dword [ebp - 0x728]
dec eax
mov dword [ebp - 0x728], eax
mov dword [ebp - 0x494], 0
jmp 0x47214f
mov eax, dword [ebp - 0x494]
dec eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 0xfffffff3
jge 0x4723ed
mov dword [ebp - 0xec], 0xf7c8b166
mov dword [ebp - 0x2a84], 0xd88c83b9
mov dword [ebp - 0x2a80], 0xd88c83b9
mov dword [ebp - 0x2a7c], 0xd88c83b9
mov dword [ebp - 0x2a78], 0xd88c83b9
mov dword [ebp - 0xc10], 0x7dc23988
mov dword [ebp - 0x24e4], 0xf6657eef
mov dword [ebp - 0x24ec], 9
cmp dword [ebp - 0x728], 0
je 0x4721d6
mov eax, dword [ebp - 0x1cc8]
mov dword [ebp - 0x2d48], eax
cmp dword [ebp - 0xec], 0
je 0x4721d6
mov dword [ebp - 0xda0], 1
jmp 0x4721dd
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x2d50], eax
mov eax, dword [ebp - 0x24dc]
cmp dword [ebp - 0xec], eax
jl 0x472203
mov dword [ebp - 0x1ca0], 1
jmp 0x47220a
and dword [ebp - 0x1ca0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x28a4]
cmp dword [ebp - 0x1ca0], eax
jl 0x47222a
mov dword [ebp - 0x1ca8], 1
jmp 0x472231
and dword [ebp - 0x1ca8], 0
mov eax, dword [ebp - 0xda0]
sub eax, dword [ebp - 0x1ca8]
imul eax, dword [ebp - 0xec]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x28a4]
sub eax, dword [ebp - 0x1cb0]
cmp eax, dword [ebp - 0x728]
jle 0x47226a
mov dword [ebp - 0xda8], 1
jmp 0x472271
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0x1cb0], eax
cmp dword [ebp - 0xec], 0
jne 0x4722c8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x28a4]
mov dword [ebp - 0xdb0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xdb0]
mov dword [ebp + eax - 0x2a84], ecx
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0xc10], eax
cmp dword [ebp - 0xc10], 0
jne 0x4722c8
and dword [ebp - 0x1cb8], 0
jmp 0x4722d2
mov dword [ebp - 0x1cb8], 1
mov eax, dword [ebp - 0x1cb8]
sub eax, dword [ebp - 0xec]
mov eax, 0x737b78f1
sub eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x494]
jl 0x472303
mov dword [ebp - 0xdb8], 1
jmp 0x47230a
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0xdb8]
jg 0x472324
mov dword [ebp - 0x1cc0], 1
jmp 0x47232b
and dword [ebp - 0x1cc0], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1cc0], eax
je 0x472345
mov dword [ebp - 0xdc0], 1
jmp 0x47234c
and dword [ebp - 0xdc0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdc0]
mov dword [ebp + eax - 0x28a4], ecx
mov eax, dword [ebp - 0xc10]
add eax, dword [ebp - 0x1cc8]
cmp dword [ebp - 0xec], eax
je 0x47237f
mov dword [ebp - 0xdc8], 1
jmp 0x472386
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0xdc8], 0xa62e26a8
je 0x47239e
mov dword [ebp - 0x1cd0], 1
jmp 0x4723a5
and dword [ebp - 0x1cd0], 0
mov eax, dword [ebp - 0x1cd0]
mov dword [ebp - 0x24e4], eax
mov dword [ebp - 0xdd0], 0
mov eax, dword [ebp - 0xdd0]
cmp dword [ebp - 0xec], eax
jl 0x4723d5
mov dword [ebp - 0x1cd8], 1
jmp 0x4723dc
and dword [ebp - 0x1cd8], 0
mov eax, dword [ebp - 0x1cd8]
mov dword [ebp - 0x24ec], eax
jmp 0x472142
mov dword [ebp - 0x414], 0x167d
mov dword [ebp - 0x150], 0
jmp 0x472410
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x47242c
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x2844], 0xad313dd3
jmp 0x472403
mov dword [ebp - 0x150], 0
jmp 0x472445
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x472461
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x35a4], 0xfffffffb
jmp 0x472438
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2844], 0xffffffe7
jmp 0x47248c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2844]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2844], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2844], 0xfffffff9
jge 0x47251f
mov dword [ebp - 0xa4c], 0xfffffffa
mov dword [ebp - 0xa4c], 2
jmp 0x4724c2
mov eax, dword [ebp - 0xa4c]
dec eax
mov dword [ebp - 0xa4c], eax
cmp dword [ebp - 0xa4c], 0
jl 0x47251a
mov dword [ebp - 0x730], 9
mov dword [ebp - 0x730], 2
jmp 0x4724ee
mov eax, dword [ebp - 0x730]
dec eax
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
jl 0x472518
mov byte [ebp - 0x3c2], 0
movzx eax, byte [ebp - 0x3c2]
test eax, eax
je 0x472516
push 0
push 0xcaf
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x4724e1
jmp 0x4724b5
jmp 0x472473
mov dword [ebp - 0x2600], 0xffffffff
mov dword [ebp - 0x3c], 0xe0648261
mov dword [ebp - 0xb0], 9
mov dword [ebp - 0x9b4], 0
jmp 0x472553
mov eax, dword [ebp - 0x9b4]
inc eax
mov dword [ebp - 0x9b4], eax
cmp dword [ebp - 0x9b4], 1
jge 0x47256f
mov eax, dword [ebp - 0x9b4]
mov dword [ebp + eax*4 - 0x60c], 0xad0d7276
jmp 0x472546
mov dword [ebp - 0x3c], 0
jmp 0x47257f
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe3
jge 0x4725b7
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x4725b5
push 0x2204
push 0
push 0x131b
push 0
push 0xd7a
push 0x8ef
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x472578
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2d58], eax
cmp dword [ebp - 0xb0], 0
je 0x4725de
cmp dword [ebp - 0xb0], 0
je 0x4725de
mov dword [ebp - 0xdd8], 1
jmp 0x4725e5
and dword [ebp - 0xdd8], 0
mov eax, dword [ebp - 0xdd8]
sub eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xb0]
je 0x47260e
cmp dword [ebp - 0xb0], 0
je 0x47260e
mov dword [ebp - 0x24f4], 1
jmp 0x472615
and dword [ebp - 0x24f4], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x2d60], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], eax
jl 0x47263b
mov dword [ebp - 0x24fc], 1
jmp 0x472642
and dword [ebp - 0x24fc], 0
mov dword [ebp - 0x3c], 0x4e6d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2d68], eax
cmp dword [ebp - 0x3c], 0
je 0x472919
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0xe10], 0xe4f9f010
mov dword [ebp - 0x1d10], 0xffffffff
mov dword [ebp - 0x250c], 0
mov dword [ebp - 0x3c], 0x12
jmp 0x472694
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffc
jl 0x4726a6
mov dword [ebp - 0x2fc], 0x9ba87a5e
jmp 0x47268d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60c], 0
jne 0x47283c
mov eax, dword [ebp - 0x2fc]
imul eax, dword [ebp - 0xb0]
cmp eax, 0xffff
jb 0x4726da
mov dword [ebp - 0x1ce0], 1
jmp 0x4726e1
and dword [ebp - 0x1ce0], 0
mov eax, dword [ebp - 0x1ce0]
sub eax, 4
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x60c]
jg 0x472705
mov dword [ebp - 0xde0], 1
jmp 0x47270c
and dword [ebp - 0xde0], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0xde0], eax
jl 0x472726
mov dword [ebp - 0x1ce8], 1
jmp 0x47272d
and dword [ebp - 0x1ce8], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x1ce8]
jns 0x472744
mov dword [ebp - 0xde8], 1
jmp 0x47274b
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0xde8], eax
jge 0x472765
mov dword [ebp - 0x1cf0], 1
jmp 0x47276c
and dword [ebp - 0x1cf0], 0
mov eax, dword [ebp - 0x1cf0]
sub eax, 0x3dac2a55
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x60c]
cmp eax, dword [ebp - 0xb0]
jg 0x472798
mov dword [ebp - 0xdf0], 1
jmp 0x47279f
and dword [ebp - 0xdf0], 0
imul eax, dword [ebp - 0xdf0], 0xaaf0
cmp eax, dword [ebp - 0xb0]
je 0x4727bd
mov dword [ebp - 0x1cf8], 1
jmp 0x4727c4
and dword [ebp - 0x1cf8], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1cf8], eax
jne 0x4727e2
push 5
pop eax
test eax, eax
jne 0x4727e2
and dword [ebp - 0xdf8], 0
jmp 0x4727ec
mov dword [ebp - 0xdf8], 1
cmp dword [ebp - 0xdf8], 0xfffb
je 0x472804
mov dword [ebp - 0x1d00], 1
jmp 0x47280b
and dword [ebp - 0x1d00], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1d00], eax
jne 0x472822
mov dword [ebp - 0xe00], 1
jmp 0x472829
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0xe00]
neg eax
jne 0x47283c
and dword [ebp - 0x1d08], 0
jmp 0x472846
mov dword [ebp - 0x1d08], 1
mov eax, dword [ebp - 0x1d08]
sub eax, dword [ebp - 0x3c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x60c], eax
cmp dword [ebp - 0x2fc], 7
jl 0x472871
mov dword [ebp - 0x2504], 1
jmp 0x472878
and dword [ebp - 0x2504], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x2d70], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xe10], eax
jne 0x47289e
mov dword [ebp - 0xe08], 1
jmp 0x4728a5
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0xe08]
mov dword [ebp - 0x1d10], eax
cmp dword [ebp - 0x1d10], 0
jne 0x4728d5
cmp dword [ebp - 0xe10], 0
jne 0x4728d5
cmp dword [ebp - 0x2fc], 0
jne 0x4728d5
and dword [ebp - 0x1d18], 0
jmp 0x4728df
mov dword [ebp - 0x1d18], 1
mov eax, dword [ebp - 0x250c]
add eax, dword [ebp - 0x1d18]
cmp eax, 0x93497140
jne 0x472907
mov eax, 0x9e1c2102
test eax, eax
je 0x472907
mov dword [ebp - 0xe18], 1
jmp 0x47290e
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0x3c], eax
jmp 0x472952
mov dword [ebp - 0x2514], 0xe30e
mov byte [ebp - 0x3f1], 0
movzx eax, byte [ebp - 0x3f1]
test eax, eax
je 0x47293f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60c]
mov dword [ebp - 0x2514], eax
cmp dword [ebp - 0xa4], 0
jne 0x472b86
cmp dword [ebp - 0x54c], 0x40c88307
je 0x472977
mov dword [ebp - 0x1d20], 1
jmp 0x47297e
and dword [ebp - 0x1d20], 0
cmp dword [ebp - 0x1d20], 2
jle 0x472993
mov dword [ebp - 0xe20], 1
jmp 0x47299a
and dword [ebp - 0xe20], 0
cmp dword [ebp - 0xe20], 0x5c7d
jg 0x4729b2
mov dword [ebp - 0x1d28], 1
jmp 0x4729b9
and dword [ebp - 0x1d28], 0
cmp dword [ebp - 0x1d28], 0xfffffff9
je 0x4729ce
mov dword [ebp - 0xe28], 1
jmp 0x4729d5
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
add eax, 0x5e2ed85c
cmp eax, dword [ebp - 0x414]
jl 0x4729f4
mov dword [ebp - 0x1d30], 1
jmp 0x4729fb
and dword [ebp - 0x1d30], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1d30], eax
jle 0x472a10
cmp dword [ebp - 0xabc], 0
cmp dword [ebp - 0xabc], 0
jne 0x472a25
mov dword [ebp - 0x251c], 1
jmp 0x472a2c
and dword [ebp - 0x251c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x738]
mov dword [ebp - 0x2d78], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x2d80], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x2d88], eax
mov eax, dword [ebp - 0xa4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x738]
cmp eax, 5
jne 0x472a91
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2920], 0
jne 0x472a91
cmp dword [ebp - 0x414], 0
jne 0x472a91
and dword [ebp - 0x25f8], 0
jmp 0x472a9b
mov dword [ebp - 0x25f8], 1
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xe30], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe30]
mov dword [ebp + eax - 0x2920], ecx
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xe30], eax
jle 0x472ad4
mov dword [ebp - 0x1d38], 1
jmp 0x472adb
and dword [ebp - 0x1d38], 0
mov eax, dword [ebp - 0x1d38]
sub eax, dword [ebp - 0x54c]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2d90], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x2d98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x738], 0x116104db
jle 0x472b24
mov dword [ebp - 0xe38], 1
jmp 0x472b2b
and dword [ebp - 0xe38], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0xe38], eax
jle 0x472b45
mov dword [ebp - 0x1d40], 1
jmp 0x472b4c
and dword [ebp - 0x1d40], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x738]
cmp dword [ebp - 0x1d40], eax
jle 0x472b6d
mov dword [ebp - 0xe40], 1
jmp 0x472b74
and dword [ebp - 0xe40], 0
cmp dword [ebp - 0xe40], 0xfffffffb
jl 0x472b86
and dword [ebp - 0x1d48], 0
jmp 0x472b90
mov dword [ebp - 0x1d48], 1
mov eax, dword [ebp - 0xabc]
cmp dword [ebp - 0x1d48], eax
jg 0x472bb0
cmp dword [ebp - 0x54c], 0
jne 0x472bb0
and dword [ebp - 0xe48], 0
jmp 0x472bba
mov dword [ebp - 0xe48], 1
mov eax, dword [ebp - 0xe48]
mov dword [ebp - 0x2600], eax
jmp 0x472094
mov dword [ebp - 0x333c], 0x61928c17
mov dword [ebp - 0x3338], 0x61928c17
mov dword [ebp - 0x3334], 0x61928c17
mov dword [ebp - 0x3330], 0x61928c17
mov dword [ebp - 0x6c4], 0xffffffff
mov dword [ebp - 0x6c4], 0
jmp 0x472c16
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 3
jg 0x472c42
mov byte [ebp - 0x2c2], 0
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x472c40
push 0
push 0x20f5
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x472c09
mov dword [ebp - 0x6c4], 0xe04822b1
cmp dword [ebp + 8], 2
jl 0x484c0d
mov dword [ebp - 0x178], 0
jmp 0x472c6f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x472c8b
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x27fc], 0xe1757117
jmp 0x472c62
mov dword [ebp - 0x178], 0
jmp 0x472ca4
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x472cc0
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x2608], 0x1dbe
jmp 0x472c97
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x27fc], 3
jmp 0x472ceb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27fc]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x27fc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x27fc], 0x19
jne 0x472d3b
mov dword [ebp - 0x554], 0x2c0d37ad
mov dword [ebp - 0x554], 0
jmp 0x472d1d
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 1
jge 0x472d39
mov eax, dword [ebp - 0x554]
mov dword [ebp + eax*4 - 0x2608], 0x51cd
jmp 0x472d10
jmp 0x472cd2
mov dword [ebp - 0x9bc], 0x928c176b
mov dword [ebp - 0x740], 0
jmp 0x472d5e
mov eax, dword [ebp - 0x740]
inc eax
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 4
jge 0x472d7a
mov eax, dword [ebp - 0x740]
mov dword [ebp + eax*4 - 0x3698], 0
jmp 0x472d51
mov dword [ebp - 0x9bc], 5
jmp 0x472d93
mov eax, dword [ebp - 0x9bc]
dec eax
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x9bc], 0xfffffff5
jg 0x472dbf
mov byte [ebp - 0x3c4], 0
movzx eax, byte [ebp - 0x3c4]
test eax, eax
je 0x472dbd
push 0
push 0xa6
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
jmp 0x472d86
mov dword [ebp - 0x2da0], 0x989d221e
mov dword [ebp - 0xc44], 0x96ee4e91
mov dword [ebp - 0x614], 0xb2c57e71
mov dword [ebp - 0x2da8], 0x2a96950a
mov dword [ebp - 0x2610], 0x40eb
mov dword [ebp - 0x748], 0
jmp 0x472e0a
mov eax, dword [ebp - 0x748]
inc eax
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 3
jge 0x472e26
mov eax, dword [ebp - 0x748]
mov dword [ebp + eax*4 - 0x285c], 0xe1757117
jmp 0x472dfd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x285c], 0
jmp 0x472e54
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x285c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x285c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x285c], 0xfffffff7
jl 0x4732ea
mov dword [ebp - 0x750], 0
mov dword [ebp - 0x3010], 0xba1a
mov dword [ebp - 0xa54], 0
jmp 0x472e95
mov eax, dword [ebp - 0xa54]
inc eax
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0xa54], 1
jge 0x472eb1
mov eax, dword [ebp - 0xa54]
mov dword [ebp + eax*4 - 0x768], 0x9b7928f
jmp 0x472e88
mov dword [ebp - 0x750], 0
jmp 0x472eca
mov eax, dword [ebp - 0x750]
dec eax
mov dword [ebp - 0x750], eax
cmp dword [ebp - 0x750], 0xfffffff5
jge 0x4732e5
mov dword [ebp - 0x758], 7
mov dword [ebp - 0x55c], 0xffffffff
mov dword [ebp - 0x9c4], 0
jmp 0x472f04
mov eax, dword [ebp - 0x9c4]
inc eax
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0x9c4], 1
jge 0x472f20
mov eax, dword [ebp - 0x9c4]
mov dword [ebp + eax*4 - 0x3018], 0x468a07c6
jmp 0x472ef7
mov dword [ebp - 0x758], 0x1a
jmp 0x472f39
mov eax, dword [ebp - 0x758]
dec eax
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0xfffffff7
jne 0x472f5b
mov dword [ebp - 0x1d50], 0x1d6a56c3
mov eax, dword [ebp - 0x1d50]
dec eax
mov dword [ebp - 0x1d50], eax
jmp 0x472f2c
mov dword [ebp - 0x55c], 0x16
jmp 0x472f74
mov eax, dword [ebp - 0x55c]
dec eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0x15
jl 0x4732e0
mov dword [ebp - 0xe70], 0xd4c0
mov dword [ebp - 0x267c], 0
mov dword [ebp - 0xa9c], 0
jmp 0x472fae
mov eax, dword [ebp - 0xa9c]
inc eax
mov dword [ebp - 0xa9c], eax
cmp dword [ebp - 0xa9c], 3
jge 0x472fca
mov eax, dword [ebp - 0xa9c]
mov dword [ebp + eax*4 - 0x3168], 0x36c1
jmp 0x472fa1
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x472fe6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov dword [ebp - 0x614], 0xfffffff2
jmp 0x472fff
mov eax, dword [ebp - 0x614]
inc eax
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 0xfffffff7
jg 0x4732db
mov dword [ebp - 0x2a24], 0
mov dword [ebp - 0x2a20], 0
mov dword [ebp - 0x2a1c], 0
mov dword [ebp - 0x2a18], 0
mov dword [ebp - 0x8bc], 0
mov dword [ebp - 0x760], 0
jmp 0x473057
mov eax, dword [ebp - 0x760]
inc eax
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 3
jge 0x473073
mov eax, dword [ebp - 0x760]
mov dword [ebp + eax*4 - 0x3178], 0xca3e
jmp 0x47304a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a24]
cmp dword [ebp - 0x2610], eax
jge 0x473094
mov dword [ebp - 0x1d60], 1
jmp 0x47309b
and dword [ebp - 0x1d60], 0
cmp dword [ebp - 0x614], 0
je 0x473145
cmp dword [ebp - 0xe70], 0x9843
jge 0x4730c0
mov dword [ebp - 0x2618], 1
jmp 0x4730c7
and dword [ebp - 0x2618], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3178]
mov dword [ebp - 0x3020], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3168], 0
jne 0x4730f8
xor eax, eax
inc eax
jne 0x4730f8
and dword [ebp - 0xe50], 0
jmp 0x473102
mov dword [ebp - 0xe50], 1
mov eax, dword [ebp - 0xe50]
add eax, dword [ebp - 0xc44]
mov dword [ebp - 0x1d58], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d58]
mov dword [ebp + eax - 0x768], ecx
cmp dword [ebp - 0x1d58], 0
je 0x473145
mov eax, 0x4a13
test eax, eax
je 0x473145
mov dword [ebp - 0xe58], 1
jmp 0x47314c
and dword [ebp - 0xe58], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3168]
cmp dword [ebp - 0xe58], eax
jne 0x47316d
mov dword [ebp - 0xe60], 1
jmp 0x473174
and dword [ebp - 0xe60], 0
mov eax, dword [ebp - 0x1d60]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x8bc]
cmp eax, dword [ebp - 0xe60]
jge 0x47319a
mov dword [ebp - 0x1d68], 1
jmp 0x4731a1
and dword [ebp - 0x1d68], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3178]
cmp eax, dword [ebp - 0x1d68]
je 0x4731c1
mov dword [ebp - 0xe68], 1
jmp 0x4731c8
and dword [ebp - 0xe68], 0
cmp dword [ebp - 0xe68], 0x57638ff4
jle 0x4731e0
mov dword [ebp - 0x1d70], 1
jmp 0x4731e7
and dword [ebp - 0x1d70], 0
mov eax, dword [ebp - 0xc44]
add eax, dword [ebp - 0x1d70]
jne 0x473201
mov dword [ebp - 0x2620], 1
jmp 0x473208
and dword [ebp - 0x2620], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xc44], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x473272
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x768]
mov dword [ebp - 0x3028], eax
cmp dword [ebp - 0xe70], 0x3a55a411
je 0x473246
mov dword [ebp - 0x1d78], 1
jmp 0x47324d
and dword [ebp - 0x1d78], 0
mov eax, dword [ebp - 0x8bc]
mov ecx, dword [ebp - 0x267c]
add ecx, dword [ebp - 0x1d78]
imul eax, ecx
test eax, eax
je 0x473272
mov dword [ebp - 0xe78], 1
jmp 0x473279
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0xe78]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x768]
je 0x47329b
mov dword [ebp - 0x1d80], 1
jmp 0x4732a2
and dword [ebp - 0x1d80], 0
mov eax, dword [ebp - 0x55c]
cmp dword [ebp - 0x1d80], eax
jg 0x4732bc
mov dword [ebp - 0xe80], 1
jmp 0x4732c3
and dword [ebp - 0xe80], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe80]
mov dword [ebp + eax - 0x768], ecx
jmp 0x472ff2
jmp 0x472f67
jmp 0x472ebd
jmp 0x472e39
mov dword [ebp - 0x74], 0
jmp 0x4732fa
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x473310
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x34a0], 0xfffffff6
jmp 0x4732f3
mov dword [ebp - 0x74], 0
jmp 0x473320
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x473336
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x20c8], 0xffffffff
jmp 0x473319
mov dword [ebp - 0x74], 0
jmp 0x473346
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x47335c
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x2dd8], 1
jmp 0x47333f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x20c8], 2
jmp 0x47338a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x20c8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20c8], 0
jl 0x4733b9
mov byte [ebp - 0x3dd], 0
movzx eax, byte [ebp - 0x3dd]
test eax, eax
je 0x4733b7
push 0xf1a
call dword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x47336f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2dd8], 0
je 0x4733f6
mov byte [ebp - 0x2c6], 0
movzx eax, byte [ebp - 0x2c6]
test eax, eax
je 0x4733f4
push 0x1a66
push 0x1542
push 0
push 0xd93
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x47342f
mov byte [ebp - 0x3c6], 0
movzx eax, byte [ebp - 0x3c6]
test eax, eax
je 0x473415
push 0x1b5a
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x34a0]
mov dword [ebp + ecx - 0x20c8], eax
mov dword [ebp - 0x3030], 0x989d221e
mov dword [ebp - 0x518], 0xffffffff
mov dword [ebp - 0x269c], 0
mov dword [ebp - 0x8c0], 0
jmp 0x473466
mov eax, dword [ebp - 0x8c0]
inc eax
mov dword [ebp - 0x8c0], eax
cmp dword [ebp - 0x8c0], 2
jge 0x473482
mov eax, dword [ebp - 0x8c0]
mov dword [ebp + eax*4 - 0x2638], 7
jmp 0x473459
mov dword [ebp - 0x518], 1
jmp 0x47349b
mov eax, dword [ebp - 0x518]
dec eax
mov dword [ebp - 0x518], eax
cmp dword [ebp - 0x518], 0
jl 0x473676
mov dword [ebp - 0x524], 0x7a888ada
mov dword [ebp - 0x524], 0
jmp 0x4734cb
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 1
jg 0x473671
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x2694], 0xfffffffe
mov dword [ebp - 0x770], 0
jmp 0x473505
mov eax, dword [ebp - 0x770]
inc eax
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 4
jge 0x473521
mov eax, dword [ebp - 0x770]
mov dword [ebp + eax*4 - 0x217c], 0xfffffff8
jmp 0x4734f8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x217c], 0
jmp 0x47354f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x217c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x217c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x217c], 1
jg 0x473589
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x217c]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x217c]
mov eax, dword [ebp + eax*4 - 0x2638]
mov dword [ebp + ecx*4 - 0x2638], eax
jmp 0x473534
mov dword [ebp - 0x8c8], 0
jmp 0x4735a2
mov eax, dword [ebp - 0x8c8]
dec eax
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 0xffffffe9
jge 0x47366c
mov dword [ebp - 0x268c], 0
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x518], eax
jne 0x4735d3
mov dword [ebp - 0x1d88], 1
jmp 0x4735da
and dword [ebp - 0x1d88], 0
mov eax, dword [ebp - 0x518]
cmp eax, dword [ebp - 0x1d88]
jne 0x4735f4
mov dword [ebp - 0x2684], 1
jmp 0x4735fb
and dword [ebp - 0x2684], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2638]
mov dword [ebp - 0x3038], eax
mov eax, dword [ebp - 0x268c]
mov dword [ebp - 0x3040], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x217c]
mov dword [ebp - 0x2694], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x217c]
cmp dword [ebp + eax - 0x217c], ecx
je 0x473654
mov dword [ebp - 0xe88], 1
jmp 0x47365b
and dword [ebp - 0xe88], 0
mov eax, dword [ebp - 0xe88]
mov dword [ebp - 0x269c], eax
jmp 0x473595
jmp 0x4734be
jmp 0x47348e
mov dword [ebp - 0xb4c], 0x96ee4e91
mov dword [ebp - 0x41c], 0xfffb
mov dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x1da8], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x41c], 0
jmp 0x4736c3
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0x2d
jl 0x47387b
mov dword [ebp - 0x26a4], 0xacde9e84
mov dword [ebp - 0x49c], 8
mov dword [ebp - 0xea8], 1
mov dword [ebp - 0x290], 0
jmp 0x473707
mov eax, dword [ebp - 0x290]
dec eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0xfffffff5
jle 0x473831
mov dword [ebp - 0x26ac], 1
mov dword [ebp - 0x778], 0x64a90c6d
mov eax, dword [ebp - 0x290]
imul eax, dword [ebp - 0x26a4]
test eax, eax
je 0x4737a9
cmp dword [ebp - 0x778], 0
jne 0x473757
mov eax, 0xa20b
test eax, eax
je 0x473757
mov dword [ebp - 0x1d90], 1
jmp 0x47375e
and dword [ebp - 0x1d90], 0
mov eax, dword [ebp - 0x778]
cmp eax, dword [ebp - 0x1d90]
jne 0x473778
mov dword [ebp - 0xe90], 1
jmp 0x47377f
and dword [ebp - 0xe90], 0
mov eax, dword [ebp - 0xe90]
mov dword [ebp - 0x49c], eax
imul eax, dword [ebp - 0x49c], 0x4ea3
imul eax, dword [ebp - 0x290]
test eax, eax
je 0x4737a9
and dword [ebp - 0x1d98], 0
jmp 0x4737b3
mov dword [ebp - 0x1d98], 1
cmp dword [ebp - 0x1d98], 0xfff7
je 0x4737cb
mov dword [ebp - 0xe98], 1
jmp 0x4737d2
and dword [ebp - 0xe98], 0
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0xe98], eax
jle 0x4737ec
mov dword [ebp - 0x1da0], 1
jmp 0x4737f3
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x26ac]
cmp eax, dword [ebp - 0x1da0]
jge 0x47380d
mov dword [ebp - 0xea0], 1
jmp 0x473814
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0xea0]
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0xea8], eax
jmp 0x4736fa
mov dword [ebp - 0x49c], 0
jmp 0x47384a
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 9
jg 0x473876
mov dword [ebp - 0x1da8], 0xfffffffd
mov eax, dword [ebp - 0x1da8]
mov dword [ebp - 0xea8], eax
cmp dword [ebp - 0x290], 0
je 0x473874
jmp 0x47383d
jmp 0x47383d
jmp 0x4736b6
mov dword [ebp - 0x63c], 0xb2c57e71
mov dword [ebp - 0x3048], 0x2a96950a
mov dword [ebp - 0x780], 0xd4e06482
mov dword [ebp - 0x26cc], 0xfc2285fa
mov dword [ebp - 0x26b4], 1
mov dword [ebp - 0x8d0], 0
jmp 0x4738c6
mov eax, dword [ebp - 0x8d0]
inc eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 2
jge 0x4738e2
mov eax, dword [ebp - 0x8d0]
mov dword [ebp + eax*4 - 0x2de4], 1
jmp 0x4738b9
mov dword [ebp - 0x780], 0
jmp 0x4738fb
mov eax, dword [ebp - 0x780]
dec eax
mov dword [ebp - 0x780], eax
cmp dword [ebp - 0x780], 0xffffffe3
jl 0x473bbe
mov dword [ebp - 0x8d8], 1
mov dword [ebp - 0x3050], 0xfffffffa
mov dword [ebp - 0x3058], 0x345fe46c
mov dword [ebp - 0x1db8], 0x78555145
mov dword [ebp - 0x3060], 0x1cb6a7f4
mov dword [ebp - 0x3068], 0xc4e2bf5f
mov dword [ebp - 0x8d8], 0
jmp 0x47395d
mov eax, dword [ebp - 0x8d8]
dec eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 0xffffffeb
jle 0x473b9a
mov dword [ebp - 0x424], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x47398d
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x4739a9
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x2dfc], 0xffffffff
jmp 0x473980
mov dword [ebp - 0x218], 0
jmp 0x4739c2
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
jge 0x4739de
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0x2df0], 0xffffffff
jmp 0x4739b5
cmp dword [ebp - 0x424], 0
je 0x473a63
mov dword [ebp - 0x3070], 0xffffffff
mov dword [ebp - 0x3078], 0x959310c1
mov dword [ebp - 0x3080], 1
mov dword [ebp - 0x3088], 0xa27289ff
mov dword [ebp - 0x3090], 0x6e9f0866
mov dword [ebp - 0x3098], 0x623b4709
mov dword [ebp - 0x424], 0
jmp 0x473a3c
mov eax, dword [ebp - 0x424]
dec eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffe6
jg 0x473a5e
mov dword [ebp - 0x1db0], 0xd1aa12af
mov eax, dword [ebp - 0x1db0]
inc eax
mov dword [ebp - 0x1db0], eax
jmp 0x473a2f
jmp 0x473b95
mov dword [ebp - 0x26d4], 0xf903
mov dword [ebp - 0xeb8], 0xe5c7
cmp dword [ebp - 0x424], 0
jne 0x473a92
cmp dword [ebp - 0x26b4], 0
jne 0x473a92
and dword [ebp - 0x26bc], 0
jmp 0x473a9c
mov dword [ebp - 0x26bc], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2de4], 7
jbe 0x473ab8
mov dword [ebp - 0x26c4], 1
jmp 0x473abf
and dword [ebp - 0x26c4], 0
cmp dword [ebp - 0x1db8], 1
jge 0x473ad4
mov dword [ebp - 0xeb0], 1
jmp 0x473adb
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xeb0]
sub eax, dword [ebp - 0x26cc]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x1db8]
cmp dword [ebp - 0xeb8], eax
jl 0x473b07
mov dword [ebp - 0x1dc0], 1
jmp 0x473b0e
and dword [ebp - 0x1dc0], 0
cmp dword [ebp - 0x1dc0], 0xffffffff
jge 0x473b23
mov dword [ebp - 0xec0], 1
jmp 0x473b2a
and dword [ebp - 0xec0], 0
cmp dword [ebp - 0xec0], 0x88307b36
je 0x473b42
mov dword [ebp - 0xc40], 1
jmp 0x473b49
and dword [ebp - 0xc40], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc40]
mov dword [ebp + eax - 0x2df0], ecx
mov eax, dword [ebp - 0x26d4]
cmp eax, dword [ebp - 0xc40]
jle 0x473b76
mov dword [ebp - 0x1dc8], 1
jmp 0x473b7d
and dword [ebp - 0x1dc8], 0
mov eax, 0x3acb6d6
sub eax, dword [ebp - 0x1dc8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2dfc], eax
jmp 0x473950
mov byte [ebp - 0x2c8], 0
movzx eax, byte [ebp - 0x2c8]
test eax, eax
je 0x473bb9
push 0x2387
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4738ee
mov byte [ebp - 0x3e9], 0
movzx eax, byte [ebp - 0x3e9]
test eax, eax
je 0x473bed
push 0x62f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov dword [ebp - 0x259c], 0x40eb
mov dword [ebp - 0x1dd0], 1
mov dword [ebp - 0xec8], 0
mov dword [ebp - 0x788], 0
jmp 0x473c24
mov eax, dword [ebp - 0x788]
inc eax
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x788], 3
jge 0x473c40
mov eax, dword [ebp - 0x788]
mov dword [ebp + eax*4 - 0x28bc], 0xfffffffc
jmp 0x473c17
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
test eax, eax
je 0x473c58
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
imul eax, dword [ebp - 0x1dd0], 0
test eax, eax
jne 0x473cc9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x28bc]
mov dword [ebp - 0x30a0], eax
mov dword [ebp - 0xec8], 0xfffffff7
mov eax, dword [ebp - 0xec8]
mov dword [ebp - 0x30a8], eax
cmp dword [ebp - 0x1dd0], 0xb263d188
jbe 0x473ca4
mov dword [ebp - 0xed0], 1
jmp 0x473cab
and dword [ebp - 0xed0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xed0]
sub ecx, dword [ebp + eax - 0x28bc]
jne 0x473cc9
and dword [ebp - 0x1dd8], 0
jmp 0x473cd3
mov dword [ebp - 0x1dd8], 1
cmp dword [ebp - 0x1dd8], 0xfffffffc
jg 0x473ce8
mov dword [ebp - 0xed8], 1
jmp 0x473cef
and dword [ebp - 0xed8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x28bc]
cmp dword [ebp - 0xed8], eax
jge 0x473d10
mov dword [ebp - 0x1de0], 1
jmp 0x473d17
and dword [ebp - 0x1de0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1de0]
mov dword [ebp + eax - 0x28bc], ecx
mov dword [ebp - 0x58], 0
jmp 0x473d3a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x473d50
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2970], 0xbcd8c45
jmp 0x473d33
mov dword [ebp - 0x58], 0
jmp 0x473d60
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x473d76
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x3508], 0
jmp 0x473d59
mov dword [ebp - 0x58], 0
jmp 0x473d86
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x473d9c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xee0], 1
jmp 0x473d7f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2970]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2970], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xee0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xee0], eax
mov dword [ebp - 0x8e0], 0
jmp 0x473deb
mov eax, dword [ebp - 0x8e0]
inc eax
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 3
jge 0x473e07
mov eax, dword [ebp - 0x8e0]
mov dword [ebp + eax*4 - 0x2808], 0xe1757117
jmp 0x473dde
mov dword [ebp - 0x4dc], 0xfffb
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x1e00], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x4dc], 0
jmp 0x473e4a
mov eax, dword [ebp - 0x4dc]
inc eax
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0x2d
jl 0x474002
mov dword [ebp - 0x274c], 0xacde9e84
mov dword [ebp - 0x42c], 8
mov dword [ebp - 0xf00], 1
mov dword [ebp - 0x268], 0
jmp 0x473e8e
cmp dword [ebp - 0x268], 0xfffffff5
jle 0x473fb8
mov dword [ebp - 0x2754], 1
mov dword [ebp - 0x790], 0x64a90c6d
mov eax, dword [ebp - 0x268]
imul eax, dword [ebp - 0x274c]
test eax, eax
je 0x473f30
cmp dword [ebp - 0x790], 0
jne 0x473ede
mov eax, 0xa20b
test eax, eax
je 0x473ede
mov dword [ebp - 0x1de8], 1
jmp 0x473ee5
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0x1de8]
jne 0x473eff
mov dword [ebp - 0xee8], 1
jmp 0x473f06
and dword [ebp - 0xee8], 0
mov eax, dword [ebp - 0xee8]
mov dword [ebp - 0x42c], eax
imul eax, dword [ebp - 0x42c], 0x4ea3
imul eax, dword [ebp - 0x268]
test eax, eax
je 0x473f30
mov dword [ebp - 0x1df0], 1
cmp dword [ebp - 0x1df0], 0xfff7
je 0x473f52
mov dword [ebp - 0xef0], 1
jmp 0x473f59
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0xef0], eax
jle 0x473f73
mov dword [ebp - 0x1df8], 1
jmp 0x473f7a
and dword [ebp - 0x1df8], 0
mov eax, dword [ebp - 0x2754]
cmp eax, dword [ebp - 0x1df8]
jge 0x473f94
mov dword [ebp - 0x42c], 0
jmp 0x473fd1
cmp dword [ebp - 0x42c], 9
jg 0x473ffd
mov dword [ebp - 0x1e00], 0xfffffffd
mov eax, dword [ebp - 0x1e00]
mov dword [ebp - 0xf00], eax
cmp dword [ebp - 0x268], 0
je 0x473ffb
jmp 0x473fc4
jmp 0x473fc4
jmp 0x473e3d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2808], 0
jmp 0x474030
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2808], 0xfffffff7
jl 0x479800
mov dword [ebp - 0x798], 0xfe4d9edb
mov dword [ebp - 0x1e08], 0x7e4a906
mov dword [ebp - 0x276c], 0xd7af2c9a
mov dword [ebp - 0x2774], 1
mov dword [ebp - 0x277c], 0
mov dword [ebp - 0x8e8], 0
jmp 0x47408f
mov eax, dword [ebp - 0x8e8]
inc eax
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x8e8], 4
jge 0x4740ab
mov eax, dword [ebp - 0x8e8]
mov dword [ebp + eax*4 - 0x27a0], 2
jmp 0x474082
mov byte [ebp - 0x3c8], 0
movzx eax, byte [ebp - 0x3c8]
test eax, eax
je 0x4740d6
push 0x1ab6
push 0x1450
push 0
push 0xd7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x30b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x27a0], 0
je 0x47411e
mov dword [ebp - 0x644], 0x3342eb9
mov dword [ebp - 0xb54], 0x997b09b3
mov dword [ebp - 0x9a8], 0
jmp 0x47982d
mov eax, dword [ebp - 0x9a8]
inc eax
mov dword [ebp - 0x9a8], eax
cmp dword [ebp - 0x9a8], 1
jge 0x479849
mov eax, dword [ebp - 0x9a8]
mov dword [ebp + eax*4 - 0xb5c], 1
jmp 0x479820
mov dword [ebp - 0x644], 0
jmp 0x479862
cmp dword [ebp - 0x644], 0x1b
jge 0x479a60
cmp dword [ebp + 8], 1
jne 0x4883a9
mov dword [ebp - 0x608], 0xffffffff
mov dword [ebp - 0x4a0], 0x3c4ab274
mov dword [ebp - 0x2a54], 0xfffffffd
mov dword [ebp - 0x2a50], 0xfffffffd
mov dword [ebp - 0x2a4c], 0xfffffffd
mov dword [ebp - 0x2a48], 0xfffffffd
mov dword [ebp - 0x18b8], 5
mov dword [ebp - 0x22cc], 0xc039ecf4
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x608], eax
jle 0x484c81
mov dword [ebp - 0x18a0], 1
jmp 0x484c88
and dword [ebp - 0x18a0], 0
mov eax, dword [ebp - 0x18a0]
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0xbf0b
jl 0x484cac
mov dword [ebp - 0x18a8], 1
jmp 0x484cb3
and dword [ebp - 0x18a8], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x324c], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x2f0c], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x18b0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x18b0]
mov dword [ebp + eax - 0x2a54], ecx
mov eax, dword [ebp - 0x18a8]
imul eax, dword [ebp - 0x18b0]
mov dword [ebp - 0x18b8], eax
mov eax, dword [ebp - 0x18b8]
mov dword [ebp - 0x22cc], eax
mov dword [ebp - 0x4a0], 0x15
jmp 0x484d22
mov eax, dword [ebp - 0x4a0]
dec eax
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0xfffffffd
jge 0x484d45
mov byte [ebp - 0x3e8], 0
movzx eax, byte [ebp - 0x3e8]
test eax, eax
je 0x484d43
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x484d15
mov dword [ebp - 0x4a8], 0xea5d6c05
mov dword [ebp - 0x774], 0
jmp 0x484d68
mov eax, dword [ebp - 0x774]
inc eax
mov dword [ebp - 0x774], eax
cmp dword [ebp - 0x774], 1
jge 0x484d84
mov eax, dword [ebp - 0x774]
mov dword [ebp + eax*4 - 0x1900], 1
jmp 0x484d5b
mov dword [ebp - 0x4a8], 0xffffffe8
jmp 0x484d9d
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0x1d
jle 0x485033
mov dword [ebp - 0xf8], 0xb4074dd0
mov dword [ebp - 0x22dc], 0xfffffff9
cmp dword [ebp - 0xf8], 0
je 0x484fb6
mov dword [ebp - 0x4b0], 0xfffffffc
mov dword [ebp - 0x22d4], 0xffffffff
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x30f4], eax
cmp dword [ebp - 0xf8], 0
je 0x484e15
mov eax, 0xa754
test eax, eax
je 0x484e15
mov dword [ebp - 0x18c8], 1
jmp 0x484e1c
and dword [ebp - 0x18c8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x18c0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18c0]
mov dword [ebp + eax - 0x1900], ecx
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x18c0], eax
jge 0x484e50
cmp dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4a8]
add eax, dword [ebp - 0x18c8]
cmp eax, 1
jl 0x484f2d
mov dword [ebp - 0x18d0], 0x946b
mov dword [ebp - 0xf8], 0
jmp 0x484e88
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfffffffb
jge 0x484f28
mov dword [ebp - 0x2f14], 0xfffffffa
mov dword [ebp - 0x77c], 0
jmp 0x484eb8
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 3
jge 0x484ed4
mov eax, dword [ebp - 0x77c]
mov dword [ebp + eax*4 - 0x364c], 0xfffffff6
jmp 0x484eab
mov byte [ebp - 0x38d], 0
movzx eax, byte [ebp - 0x38d]
test eax, eax
je 0x484f16
push 0x63
push 0
push 0x20d0
push 0x157e
push 0xf
push 0
push 0x155d
push 0x8f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov eax, dword [ebp - 0x18d0]
dec eax
mov dword [ebp - 0x18d0], eax
jmp 0x484e7b
jmp 0x484fb4
mov eax, dword [ebp - 0x22d4]
cmp dword [ebp - 0x22dc], eax
jl 0x484f47
mov dword [ebp - 0x18d8], 1
jmp 0x484f4e
and dword [ebp - 0x18d8], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x4b0]
add eax, dword [ebp - 0x18d8]
add ecx, eax
cmp dword [ebp - 0x4b0], ecx
jne 0x484f82
mov dword [ebp - 0x18e0], 1
jmp 0x484f89
and dword [ebp - 0x18e0], 0
cmp dword [ebp - 0x18e0], 0xb063
jle 0x484fa1
mov dword [ebp - 0x18e8], 1
jmp 0x484fa8
and dword [ebp - 0x18e8], 0
mov eax, dword [ebp - 0x18e8]
mov dword [ebp - 0x4b0], eax
jmp 0x48502e
mov dword [ebp - 0xb48], 0xfc5674fa
mov dword [ebp - 0x18f8], 0xc8d535dd
mov eax, dword [ebp - 0xb48]
sub eax, 0x5ef13550
mov dword [ebp - 0x22e4], eax
mov eax, dword [ebp - 0x18f8]
mov dword [ebp - 0x22ec], eax
mov eax, dword [ebp - 0xb48]
inc eax
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0x22e4]
cmp eax, dword [ebp - 0x22ec]
je 0x48500e
mov dword [ebp - 0x18f0], 1
jmp 0x485015
and dword [ebp - 0x18f0], 0
mov eax, dword [ebp - 0x18f0]
sub eax, dword [ebp - 0x18f8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1900], eax
jmp 0x484d90
mov dword [ebp - 0x124], 0x3d83
mov dword [ebp - 0xb50], 0xffffffff
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x134], 0x4b969b42
mov dword [ebp - 0x610], 0x17cd9532
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x3304], eax
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x124], eax
jge 0x48508b
mov dword [ebp - 0x1908], 1
jmp 0x485092
and dword [ebp - 0x1908], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x1908], eax
jge 0x4850ac
mov dword [ebp - 0x1910], 1
jmp 0x4850b3
and dword [ebp - 0x1910], 0
mov eax, dword [ebp - 0x1910]
neg eax
sub eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x124]
jl 0x4850d5
mov dword [ebp - 0x1918], 1
jmp 0x4850dc
and dword [ebp - 0x1918], 0
cmp dword [ebp - 0x1918], 0x478c9dff
jne 0x4850f4
mov dword [ebp - 0x1920], 1
jmp 0x4850fb
and dword [ebp - 0x1920], 0
mov eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x1920]
cmp eax, dword [ebp - 0x12c]
jle 0x48511c
mov dword [ebp - 0x1928], 1
jmp 0x485123
and dword [ebp - 0x1928], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x134]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x12c], eax
jl 0x485150
mov dword [ebp - 0x1930], 1
jmp 0x485157
and dword [ebp - 0x1930], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x1930], eax
jle 0x485171
mov dword [ebp - 0x1938], 1
jmp 0x485178
and dword [ebp - 0x1938], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0x2f1c], eax
mov eax, dword [ebp - 0x1938]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x30fc], eax
push 6
pop eax
add eax, 0x4b14151c
cmp eax, 0xab6ce1a8
jbe 0x4851c3
mov dword [ebp - 0x22f4], 1
jmp 0x4851ca
and dword [ebp - 0x22f4], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2f24], eax
mov dword [ebp - 0x610], 0xc7279c90
mov dword [ebp - 0x12c], 0
jmp 0x4851f9
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xffffffe5
je 0x485700
mov dword [ebp - 0x784], 1
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x20c], 0x8211abd
mov dword [ebp - 0x204], 0
jmp 0x48523d
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x485259
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x4b8], 1
jmp 0x485230
mov dword [ebp - 0x204], 0
jmp 0x485272
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x48528e
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x21dc], 0xffffffff
jmp 0x485265
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4b8], 0
jb 0x4852aa
mov dword [ebp - 0x19a0], 1
jmp 0x4852b1
and dword [ebp - 0x19a0], 0
cmp dword [ebp - 0x134], 0
je 0x4852cf
cmp dword [ebp - 0x12c], 0
je 0x4852cf
mov dword [ebp - 0x1950], 1
jmp 0x4852d6
and dword [ebp - 0x1950], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b8]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x4b8]
add ecx, dword [ebp - 0x1950]
sub eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x4b8]
jg 0x485313
mov dword [ebp - 0x1958], 1
jmp 0x48531a
and dword [ebp - 0x1958], 0
mov eax, dword [ebp - 0x784]
add eax, dword [ebp - 0x1958]
neg eax
mov dword [ebp - 0x1960], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1960]
mov dword [ebp + eax - 0x21dc], ecx
cmp dword [ebp - 0x1960], 0
jne 0x48535c
cmp dword [ebp - 0x12c], 0
jne 0x48535c
and dword [ebp - 0x1968], 0
jmp 0x485366
mov dword [ebp - 0x1968], 1
cmp dword [ebp - 0x1968], 8
jne 0x48537b
mov dword [ebp - 0x1970], 1
jmp 0x485382
and dword [ebp - 0x1970], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x1970], eax
je 0x48539c
mov dword [ebp - 0x1978], 1
jmp 0x4853a3
and dword [ebp - 0x1978], 0
mov eax, dword [ebp - 0x1978]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x60d9
jge 0x4853c7
mov dword [ebp - 0x1980], 1
jmp 0x4853ce
and dword [ebp - 0x1980], 0
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x4853f8
cmp dword [ebp - 0x134], 0
je 0x4853f8
mov dword [ebp - 0x1988], 1
jmp 0x4853ff
and dword [ebp - 0x1988], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b8]
cmp eax, dword [ebp - 0x1988]
jne 0x485420
mov dword [ebp - 0x1990], 1
jmp 0x485427
and dword [ebp - 0x1990], 0
cmp dword [ebp - 0x1990], 0xfffffffd
jl 0x48543c
mov dword [ebp - 0x22fc], 1
jmp 0x485443
and dword [ebp - 0x22fc], 0
cmp dword [ebp - 0x214], 0
jne 0x48545e
cmp dword [ebp - 0x784], 0
jne 0x48545e
and dword [ebp - 0x1998], 0
jmp 0x485468
mov dword [ebp - 0x1998], 1
mov eax, dword [ebp - 0x1998]
sub eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x784]
jne 0x485488
mov dword [ebp - 0x2304], 1
jmp 0x48548f
and dword [ebp - 0x2304], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x3254], eax
mov eax, dword [ebp - 0xb50]
cmp dword [ebp - 0x19a0], eax
jle 0x4854b5
mov dword [ebp - 0x19a8], 1
jmp 0x4854bc
and dword [ebp - 0x19a8], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x19a8], eax
jne 0x4854d6
mov dword [ebp - 0x19b0], 1
jmp 0x4854dd
and dword [ebp - 0x19b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4b8]
imul eax, dword [ebp - 0x19b0]
test eax, eax
jne 0x485502
cmp dword [ebp - 0x214], 0
je 0x4856df
mov dword [ebp - 0x2314], 1
mov dword [ebp - 0x20c], 0
jmp 0x485525
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jg 0x4856c1
mov dword [ebp - 0xb58], 0xffffffff
mov dword [ebp - 0x230c], 0xafe108d8
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp + eax*4 - 0x21dc]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x20c]
mov eax, dword [ebp + eax*4 - 0x21dc]
cmp eax, dword [ebp - 0xb58]
jle 0x48557a
mov dword [ebp - 0x19c0], 1
jmp 0x485581
and dword [ebp - 0x19c0], 0
mov eax, dword [ebp - 0x610]
mov ecx, dword [ebp - 0x20c]
add eax, dword [ebp + ecx*4 - 0x21dc]
cmp eax, dword [ebp - 0x230c]
jne 0x4855a8
mov dword [ebp - 0x19b8], 1
jmp 0x4855af
and dword [ebp - 0x19b8], 0
mov eax, dword [ebp - 0x784]
cmp dword [ebp - 0x19b8], eax
jne 0x4855c9
mov dword [ebp - 0x19c8], 1
jmp 0x4855d0
and dword [ebp - 0x19c8], 0
mov eax, dword [ebp - 0x19c0]
neg eax
neg eax
imul eax, eax, 0x4693
mov ecx, dword [ebp - 0x19c8]
neg ecx
cmp eax, ecx
jg 0x485601
cmp dword [ebp - 0xb58], 0
je 0x485601
mov dword [ebp - 0x19d0], 1
jmp 0x485608
and dword [ebp - 0x19d0], 0
cmp dword [ebp - 0x19d0], 0x10da
jl 0x485620
mov dword [ebp - 0x19d8], 1
jmp 0x485627
and dword [ebp - 0x19d8], 0
mov dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x19d8]
jl 0x48564b
mov dword [ebp - 0x19e0], 1
jmp 0x485652
and dword [ebp - 0x19e0], 0
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x19e0], eax
jge 0x48566c
mov dword [ebp - 0x19e8], 1
jmp 0x485673
and dword [ebp - 0x19e8], 0
mov eax, dword [ebp - 0x19e8]
mov dword [ebp - 0x2314], eax
mov dword [ebp - 0x214], 2
jmp 0x485698
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x4856bc
mov eax, dword [ebp - 0x214]
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax*4 - 0x21dc]
mov dword [ebp + ecx - 0x21dc], eax
jmp 0x48568b
jmp 0x485518
mov byte [ebp - 0x3ea], 0
movzx eax, byte [ebp - 0x3ea]
test eax, eax
je 0x4856dd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x4856fb
mov byte [ebp - 0x395], 0
movzx eax, byte [ebp - 0x395]
test eax, eax
je 0x4856fb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x4851ec
mov dword [ebp - 0x628], 0xffffffff
mov dword [ebp - 0xc0], 0x4cd45360
mov dword [ebp - 0x1a08], 0x67c28cae
mov dword [ebp - 0xb60], 0xfffffffd
mov dword [ebp - 0x2f2c], 0xda5659cd
mov dword [ebp - 0x3104], 0
mov dword [ebp - 0x618], 0xffffffff
mov dword [ebp - 0x2f34], 0xfc53d8b3
mov dword [ebp - 0x32cc], 0xffffffff
mov dword [ebp - 0x2334], 0x7461d0ee
mov dword [ebp - 0x2f3c], 0x228d029b
mov dword [ebp - 0x1a88], 2
mov dword [ebp - 0x310c], 0x7cb0be94
mov dword [ebp - 0x2f44], 1
mov dword [ebp - 0x233c], 0x131b3b33
mov dword [ebp - 0x325c], 0x4730e92f
mov dword [ebp - 0x2f4c], 0xfffffffe
mov dword [ebp - 0x3114], 0xfffffffd
mov dword [ebp - 0x1a38], 0xdcfc
mov dword [ebp - 0x21c], 0
jmp 0x4857d7
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x4857f3
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0xc28], 9
jmp 0x4857ca
mov dword [ebp - 0x21c], 0
jmp 0x48580c
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x485828
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x234c], 0x91f3a4b4
jmp 0x4857ff
mov dword [ebp - 0xc0], 0
jmp 0x485841
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x485af5
mov dword [ebp - 0x1a30], 1
mov dword [ebp - 0x231c], 0
mov dword [ebp - 0x2f54], 4
mov dword [ebp - 0x28d8], 0
mov dword [ebp - 0x28d4], 0
mov dword [ebp - 0x28d0], 0
mov dword [ebp - 0x28cc], 0
mov dword [ebp - 0x224], 0
jmp 0x4858ad
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x4858c9
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x3324], 0xecaa7054
jmp 0x4858a0
mov dword [ebp - 0x224], 0
jmp 0x4858e2
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jge 0x4858fe
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x3550], 0x6ef5427e
jmp 0x4858d5
mov eax, dword [ebp - 0xc0]
mov ecx, 0x34ac
sub ecx, dword [ebp + eax*4 - 0xc28]
cmp ecx, 0xffffffff
je 0x485921
mov dword [ebp - 0x19f0], 1
jmp 0x485928
and dword [ebp - 0x19f0], 0
mov eax, dword [ebp - 0x1a08]
cmp eax, dword [ebp - 0x19f0]
jge 0x485942
mov dword [ebp - 0x19f8], 1
jmp 0x485949
and dword [ebp - 0x19f8], 0
cmp dword [ebp - 0x19f8], 0xbc9fa8bc
ja 0x485961
mov dword [ebp - 0x1a00], 1
jmp 0x485968
and dword [ebp - 0x1a00], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xc28]
cmp dword [ebp - 0x1a00], eax
je 0x485989
mov dword [ebp - 0x1a10], 1
jmp 0x485990
and dword [ebp - 0x1a10], 0
mov eax, dword [ebp - 0x1a08]
cmp dword [ebp - 0x1a10], eax
je 0x4859aa
mov dword [ebp - 0x1a18], 1
jmp 0x4859b1
and dword [ebp - 0x1a18], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1a18], eax
jle 0x4859cb
mov dword [ebp - 0x1a20], 1
jmp 0x4859d2
and dword [ebp - 0x1a20], 0
mov eax, dword [ebp - 0x1a20]
sub eax, 0x4f77722a
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xc28]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb60]
mov ecx, dword [ebp - 0xc0]
add eax, dword [ebp + ecx*4 - 0xc28]
jne 0x485a12
xor eax, eax
jne 0x485a12
and dword [ebp - 0x1a28], 0
jmp 0x485a1c
mov dword [ebp - 0x1a28], 1
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xc28]
add eax, dword [ebp - 0x1a28]
mov dword [ebp - 0x1a30], eax
mov eax, dword [ebp - 0x231c]
cmp dword [ebp - 0x1a30], eax
jge 0x485a4f
mov dword [ebp - 0x2324], 1
jmp 0x485a56
and dword [ebp - 0x2324], 0
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0xc28]
mov dword [ebp - 0x2f5c], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp + eax*4 - 0xc28], 0x68d5
jge 0x485a88
mov dword [ebp - 0x232c], 1
jmp 0x485a8f
and dword [ebp - 0x232c], 0
mov eax, 0x20a2e71c
test eax, eax
je 0x485ab6
mov byte [ebp - 0x3ec], 0
movzx eax, byte [ebp - 0x3ec]
test eax, eax
je 0x485ab4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x485ad7
mov byte [ebp - 0x39d], 0
movzx eax, byte [ebp - 0x39d]
test eax, eax
je 0x485ad7
push 0
push 0x20f5
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x28d8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x28d8], eax
jmp 0x485834
mov dword [ebp - 0x1a38], 0x396c
cmp dword [ebp - 0x1a38], 0
je 0x485b22
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x2334], eax
jne 0x485b22
mov dword [ebp - 0x1a40], 1
jmp 0x485b29
and dword [ebp - 0x1a40], 0
cmp dword [ebp - 0x1a40], 0xeb6b
je 0x485b41
mov dword [ebp - 0x1a48], 1
jmp 0x485b48
and dword [ebp - 0x1a48], 0
cmp dword [ebp - 0x1a48], 0x3f43c5ea
jge 0x485b60
mov dword [ebp - 0x1a50], 1
jmp 0x485b67
and dword [ebp - 0x1a50], 0
cmp dword [ebp - 0x1a50], 0xa091cddc
jne 0x485b7f
mov dword [ebp - 0x1a58], 1
jmp 0x485b86
and dword [ebp - 0x1a58], 0
mov eax, dword [ebp - 0x233c]
imul eax, dword [ebp - 0x1a58]
cmp eax, dword [ebp - 0x618]
jne 0x485ba7
mov dword [ebp - 0x1a60], 1
jmp 0x485bae
and dword [ebp - 0x1a60], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x1a60]
test eax, eax
jne 0x485bd1
cmp dword [ebp - 0x618], 0
jne 0x485bd1
and dword [ebp - 0x1a68], 0
jmp 0x485bdb
mov dword [ebp - 0x1a68], 1
mov eax, dword [ebp - 0x618]
cmp dword [ebp - 0x1a68], eax
jge 0x485bfe
mov eax, 0x870e2673
test eax, eax
je 0x485bfe
mov dword [ebp - 0x1a70], 1
jmp 0x485c05
and dword [ebp - 0x1a70], 0
cmp dword [ebp - 0x1a70], 0xc5b50a70
je 0x485c1d
mov dword [ebp - 0x1a78], 1
jmp 0x485c24
and dword [ebp - 0x1a78], 0
mov eax, dword [ebp - 0x1a88]
cmp eax, dword [ebp - 0x1a78]
jg 0x485c3e
mov dword [ebp - 0x2344], 1
jmp 0x485c45
and dword [ebp - 0x2344], 0
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
sub ecx, dword [ebp - 0x618]
cmp dword [ebp + eax - 0x234c], ecx
jl 0x485c68
mov dword [ebp - 0x1a80], 1
jmp 0x485c6f
and dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0x618]
mov ecx, dword [ebp - 0x1a80]
lea eax, [ecx + eax + 9]
cmp eax, 0xadf1
jl 0x485c98
cmp dword [ebp - 0x1a88], 0
jne 0x485c98
and dword [ebp - 0x1a90], 0
jmp 0x485ca2
mov dword [ebp - 0x1a90], 1
cmp dword [ebp - 0x1a90], 0xbc62
jge 0x485cba
mov dword [ebp - 0x1a98], 1
jmp 0x485cc1
and dword [ebp - 0x1a98], 0
cmp dword [ebp - 0x1a98], 0x3dcc
jge 0x485cd9
mov dword [ebp - 0x1aa0], 1
jmp 0x485ce0
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0x1aa0]
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0x4e0], 0x3c4ab274
mov dword [ebp - 0x794], 0x56a9ef72
mov dword [ebp - 0x2354], 1
mov dword [ebp - 0x1aa8], 0xb13281d2
mov dword [ebp - 0x236c], 0xfffffff9
mov dword [ebp - 0x311c], 0xfffffffa
mov dword [ebp - 0x2f64], 0xb28ed4a5
mov dword [ebp - 0x1ab0], 0x1e2d
mov dword [ebp - 0x3264], 0x56cd8339
mov dword [ebp - 0x78c], 0
jmp 0x485d5f
mov eax, dword [ebp - 0x78c]
inc eax
mov dword [ebp - 0x78c], eax
cmp dword [ebp - 0x78c], 4
jge 0x485d7b
mov eax, dword [ebp - 0x78c]
mov dword [ebp + eax*4 - 0x36d8], 0xab227d3
jmp 0x485d52
cmp dword [ebp - 0x794], 0
je 0x485db0
mov eax, dword [ebp - 0x794]
add eax, dword [ebp - 0x2354]
mov dword [ebp - 0x1aa8], eax
mov eax, dword [ebp - 0x1aa8]
cmp dword [ebp - 0x794], eax
je 0x485db0
mov dword [ebp - 0x235c], 1
jmp 0x485db7
and dword [ebp - 0x235c], 0
cmp dword [ebp - 0x794], 0x31d26ec1
je 0x485dcf
mov dword [ebp - 0x2364], 1
jmp 0x485dd6
and dword [ebp - 0x2364], 0
mov dword [ebp - 0x236c], 0xfffffffd
mov eax, dword [ebp - 0x1ab0]
dec eax
mov dword [ebp - 0x1ab0], eax
mov dword [ebp - 0x2a74], 0xfffffffd
mov dword [ebp - 0x2a70], 0xfffffffd
mov dword [ebp - 0x2a6c], 0xfffffffd
mov dword [ebp - 0x2a68], 0xfffffffd
mov dword [ebp - 0x2a4], 0x15252cb1
mov dword [ebp - 0x79c], 0
jmp 0x485e38
mov eax, dword [ebp - 0x79c]
inc eax
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 3
jge 0x485e54
mov eax, dword [ebp - 0x79c]
mov dword [ebp + eax*4 - 0x216c], 0xfff9
jmp 0x485e2b
mov byte [ebp - 0x3ee], 0
movzx eax, byte [ebp - 0x3ee]
test eax, eax
je 0x485e73
push 0x7e9
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov dword [ebp - 0x2a4], 2
jmp 0x485e8c
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jl 0x4860e7
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1ac0], 0xc8af9534
mov dword [ebp - 0x1ac8], 2
mov dword [ebp - 0x1ad0], 1
mov dword [ebp - 0x30], 0
jmp 0x485ece
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x485ee4
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x216c], 0x2eac
jmp 0x485ec7
mov dword [ebp - 0x30], 2
jmp 0x485ef4
cmp dword [ebp - 0x30], 0
jl 0x4860e2
mov dword [ebp - 0x4c0], 0x65e08ccc
mov dword [ebp - 0x4c0], 0
jmp 0x485f21
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 3
jge 0x485f3d
mov eax, dword [ebp - 0x4c0]
mov dword [ebp + eax*4 - 0x216c], 0xd1d8
jmp 0x485f14
mov eax, dword [ebp - 0x30]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x216c]
cmp dword [ebp + eax*4 - 0x216c], ecx
jge 0x485f67
cmp dword [ebp - 0x30], 0
je 0x485f67
mov dword [ebp - 0x1ab8], 1
jmp 0x485f6e
and dword [ebp - 0x1ab8], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x1ab8], eax
jg 0x485f80
cmp dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1ac0], eax
mov eax, dword [ebp - 0x1ac0]
mov dword [ebp - 0x1ac8], eax
mov eax, dword [ebp - 0x1ac8]
add eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x1ad0], eax
mov eax, dword [ebp - 0x1ad0]
sub eax, 0x58d0
mov ecx, dword [ebp - 0x30]
imul eax, dword [ebp + ecx*4 - 0x216c]
test eax, eax
jg 0x485fd0
mov dword [ebp - 0x1ad8], 1
jmp 0x485fd7
and dword [ebp - 0x1ad8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x216c]
cmp dword [ebp - 0x1ad8], eax
jl 0x485ff8
jmp 0x485e7f
mov dword [ebp - 0xcdc], 5
mov dword [ebp - 0x2f6c], 0xeac8b13e
mov byte [ebp - 0x3a5], 0
movzx eax, byte [ebp - 0x3a5]
test eax, eax
je 0x486120
push 0
push 0
push 0x231f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x3f0], 0
movzx eax, byte [ebp - 0x3f0]
test eax, eax
je 0x486148
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [ebp - 0x238c], 0xc039ecf4
mov dword [ebp - 0x2b4], 0x90ac204e
mov dword [ebp - 0x38c], 0xbc42
mov dword [ebp - 0x2374], 0
mov dword [ebp - 0x1b90], 0xad3f04e2
mov dword [ebp - 0x2b4], 0x13
jmp 0x486193
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x15
je 0x4863c1
mov dword [ebp - 0x7ac], 0x95e17ca0
mov dword [ebp - 0x7a4], 0
jmp 0x4861c3
mov eax, dword [ebp - 0x7a4]
inc eax
mov dword [ebp - 0x7a4], eax
cmp dword [ebp - 0x7a4], 1
jge 0x4861df
mov eax, dword [ebp - 0x7a4]
mov dword [ebp + eax*4 - 0x7b4], 0xea12
jmp 0x4861b6
mov dword [ebp - 0x7ac], 0
jmp 0x4861f8
cmp dword [ebp - 0x7ac], 0x14
je 0x4863bc
mov dword [ebp - 0x2ac], 0x6c3a0b8e
mov dword [ebp - 0x1b50], 5
mov dword [ebp - 0x2ac], 0
jmp 0x486232
cmp dword [ebp - 0x2ac], 0
jl 0x4863b7
jmp 0x486186
mov dword [ebp - 0x38c], 1
jmp 0x4863da
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x26
jge 0x486675
mov dword [ebp - 0x4c8], 0x932384b6
mov dword [ebp - 0x1b70], 0xfffffffe
mov dword [ebp - 0x2b4], 0xffffffe3
jmp 0x486414
cmp dword [ebp - 0x2b4], 0xfffffff8
jge 0x486670
mov dword [ebp - 0x2384], 0xf3a8a1d5
mov dword [ebp - 0x7bc], 0
jmp 0x486444
cmp dword [ebp - 0x7bc], 1
jge 0x486460
jmp 0x4863cd
mov eax, dword [ebp - 0x628]
cmp dword [ebp - 0x628], eax
jle 0x48668f
mov dword [ebp - 0xcc4], 1
jmp 0x486696
and dword [ebp - 0xcc4], 0
mov eax, dword [ebp - 0xcc4]
mov dword [ebp - 0x4e0], eax
cmp dword [ebp - 0x4e0], 0xbf0b
jl 0x4866ba
mov dword [ebp - 0xccc], 1
jmp 0x4866c1
and dword [ebp - 0xccc], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x3124], eax
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x2f74], eax
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xcd4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcd4]
mov dword [ebp + eax - 0x2a74], ecx
mov eax, dword [ebp - 0xccc]
imul eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xcdc], eax
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0x238c], eax
mov dword [ebp - 0x4d0], 0xffffffff
mov dword [ebp - 0x7c4], 0
jmp 0x48673a
cmp dword [ebp - 0x7c4], 3
jge 0x486756
mov dword [ebp - 0x650], 0x4a18885c
mov dword [ebp - 0x854], 0
jmp 0x4883cc
mov eax, dword [ebp - 0x854]
inc eax
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 2
jge 0x4883e8
mov eax, dword [ebp - 0x854]
mov dword [ebp + eax*4 - 0x2674], 0x9b3198a8
jmp 0x4883bf
mov dword [ebp - 0x650], 1
jmp 0x488401
mov eax, dword [ebp - 0x650]
dec eax
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
jl 0x488611
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x658], 1
jmp 0x488431
mov eax, dword [ebp - 0x658]
dec eax
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0
jl 0x48860c
mov dword [ebp - 0x250], 0x3e9323d1
mov dword [ebp - 0x250], 1
jmp 0x488461
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jl 0x48854d
mov dword [ebp - 0x85c], 0xfffffff9
mov dword [ebp - 0x85c], 0
jmp 0x488491
mov eax, dword [ebp - 0x85c]
inc eax
mov dword [ebp - 0x85c], eax
cmp dword [ebp - 0x85c], 1
jg 0x488548
mov dword [ebp - 0x660], 0xfffffffd
mov dword [ebp - 0x660], 0
jmp 0x4884c1
mov eax, dword [ebp - 0x660]
inc eax
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 1
jg 0x488543
mov dword [ebp - 0x864], 0xbb00868b
mov dword [ebp - 0x864], 0
jmp 0x4884ed
mov eax, dword [ebp - 0x864]
inc eax
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 1
jg 0x488524
mov byte [ebp - 0x3d5], 0
movzx eax, byte [ebp - 0x3d5]
test eax, eax
je 0x488510
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0x650]
cmp dword [ebp + eax*4 - 0x2674], 0
je 0x488522
jmp 0x488524
jmp 0x4884e0
mov eax, dword [ebp - 0x658]
mov ecx, dword [ebp - 0x660]
mov eax, dword [ebp + eax*4 - 0x2674]
mov dword [ebp + ecx*4 - 0x2674], eax
jmp 0x4884b4
jmp 0x488484
jmp 0x488454
mov dword [ebp - 0x250], 0
jmp 0x488566
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jg 0x488607
mov dword [ebp - 0x86c], 0
jmp 0x48858c
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 3
jge 0x4885a8
mov eax, dword [ebp - 0x86c]
mov dword [ebp + eax*4 - 0x28c8], 0xffffffff
jmp 0x48857f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x28c8], 0
jmp 0x4885d6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x28c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x28c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x28c8], 1
jg 0x488602
mov byte [ebp - 0x3b6], 0
movzx eax, byte [ebp - 0x3b6]
test eax, eax
je 0x488600
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x4885bb
jmp 0x488559
jmp 0x488424
jmp 0x4883f4
xor ecx, ecx
call fcn.00448452
push eax
call fcn.0048d042
pop ecx
mov dword [ebp - 0x2b48], 0xfffffff6
mov byte [ebp - 0x3e5], 0
movzx eax, byte [ebp - 0x3e5]
test eax, eax
je 0x48865b
push 0
push 0xdf3
push 0x6b5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov byte [ebp - 0x3b8], 0
movzx eax, byte [ebp - 0x3b8]
test eax, eax
je 0x488677
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov dword [ebp - 0x874], 0xcb13638e
mov dword [ebp - 0x2b50], 0x576c5165
mov dword [ebp - 0x2b58], 0xec7516a2
mov dword [ebp - 0x2b60], 1
mov dword [ebp - 0x2b68], 0xbbd0a708
mov dword [ebp - 0x2b70], 8
mov dword [ebp - 0xff4], 0
mov dword [ebp - 0x70], 0
jmp 0x4886cd
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x4886e3
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x33c8], 0x3342eb90
jmp 0x4886c6
mov dword [ebp - 0x70], 0
jmp 0x4886f3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x488709
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x2b78], 0xf29acd40
jmp 0x4886ec
mov dword [ebp - 0x70], 0
jmp 0x488719
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x48872f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x3658], 0
jmp 0x488712
mov dword [ebp - 0x874], 2
jmp 0x488748
mov eax, dword [ebp - 0x874]
dec eax
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
jl 0x4887ad
mov dword [ebp - 0x87c], 0xc4530722
mov dword [ebp - 0x87c], 2
jmp 0x488774
mov eax, dword [ebp - 0x87c]
dec eax
mov dword [ebp - 0x87c], eax
cmp dword [ebp - 0x87c], 0
jl 0x488799
mov byte [ebp - 0x3d7], 0
movzx eax, byte [ebp - 0x3d7]
test eax, eax
je 0x488797
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x488767
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x33c8], 0
je 0x4887ab
jmp 0x48873b
jmp 0x48873b
mov eax, dword [ebp - 0xff4]
dec eax
mov dword [ebp - 0xff4], eax
push 0
push 0
push 0
push 0
push 0x19
push 0x64
push 0x1863b
push 0x18695
push 0x90000000
push 0xab2784
push 0xab2784
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0x500], 0x692b
mov dword [ebp - 0xbb8], 0x46758e35
cmp dword [ebp - 0x500], 0
je 0x488982
mov dword [ebp - 0x244], 0
jmp 0x488827
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x488843
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x33e0], 0xffffffff
jmp 0x48881a
mov dword [ebp - 0x244], 0
jmp 0x48885c
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x488878
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xba8], 0xffffffff
jmp 0x48884f
mov dword [ebp - 0x500], 0
jmp 0x488891
mov eax, dword [ebp - 0x500]
inc eax
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x500], 0x1c
jge 0x488980
mov dword [ebp - 0xbb0], 0xfffffff9
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x2b80], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0x2b88], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xba8]
cmp dword [ebp + eax - 0xba8], ecx
jle 0x4888e8
mov dword [ebp - 0xffc], 1
jmp 0x4888ef
and dword [ebp - 0xffc], 0
mov eax, dword [ebp - 0xbb0]
cmp dword [ebp - 0xffc], eax
jge 0x488909
mov dword [ebp - 0x243c], 1
jmp 0x488910
and dword [ebp - 0x243c], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x33e0], 0x3718
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xba8]
mov dword [ebp - 0x2b90], eax
cmp dword [ebp - 0xbb0], 0xffffffff
jne 0x48895a
mov byte [ebp - 0x3ba], 0
movzx eax, byte [ebp - 0x3ba]
test eax, eax
je 0x488958
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x48897b
mov byte [ebp - 0x3ed], 0
movzx eax, byte [ebp - 0x3ed]
test eax, eax
je 0x48897b
push 0x1db2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
jmp 0x488884
jmp 0x48898c
mov dword [ebp - 0xbb8], 0xffffffff
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xbb8], eax
push 5
push dword [ebp - 0xbc0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x670], 0xfffffffc
mov dword [ebp - 0x884], 0
jmp 0x4889c9
mov eax, dword [ebp - 0x884]
inc eax
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 4
jge 0x4889e5
mov eax, dword [ebp - 0x884]
mov dword [ebp + eax*4 - 0x3374], 0x34504cd4
jmp 0x4889bc
mov byte [ebp - 0x3bc], 0
movzx eax, byte [ebp - 0x3bc]
test eax, eax
je 0x4889ff
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov dword [ebp - 0x670], 0
jmp 0x488a18
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 3
jg 0x488b2c
mov dword [ebp - 0x668], 1
mov dword [ebp - 0x668], 0
jmp 0x488a48
mov eax, dword [ebp - 0x668]
inc eax
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 3
jg 0x488b27
mov dword [ebp - 0x88c], 0
jmp 0x488a6e
mov eax, dword [ebp - 0x88c]
inc eax
mov dword [ebp - 0x88c], eax
cmp dword [ebp - 0x88c], 2
jge 0x488a8a
mov eax, dword [ebp - 0x88c]
mov dword [ebp + eax*4 - 0x21a4], 0xd2e8588d
jmp 0x488a61
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x21a4], 0
jmp 0x488ab8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21a4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x21a4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21a4], 3
jg 0x488b08
mov byte [ebp - 0x3d9], 0
movzx eax, byte [ebp - 0x3d9]
test eax, eax
je 0x488aec
push 0x12c2
push 0
push 0xb4c
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x670]
mov eax, dword [ebp + eax*4 - 0x3374]
mov dword [ebp + ecx*4 - 0x3374], eax
jmp 0x488a9d
mov byte [ebp - 0x3be], 0
movzx eax, byte [ebp - 0x3be]
test eax, eax
je 0x488b22
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x488a3b
jmp 0x488a0b
push dword [ebp - 0xbc0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [ebp - 0x678], 0xc184c506
mov dword [ebp - 0x2b98], 0xfff7
mov dword [ebp - 0x894], 0
jmp 0x488b65
mov eax, dword [ebp - 0x894]
inc eax
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 2
jge 0x488b81
mov eax, dword [ebp - 0x894]
mov dword [ebp + eax*4 - 0x2ec8], 0xffffffff
jmp 0x488b58
mov dword [ebp - 0x678], 0
jmp 0x488b9a
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp dword [ebp - 0x678], 1
jg 0x488bb7
mov eax, dword [ebp - 0x678]
cmp dword [ebp + eax*4 - 0x2ec8], 0
je 0x488bb5
jmp 0x488bb7
jmp 0x488b8d
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x2444], eax
lea eax, [ebp - 0x2444]
push eax
push fcn.00470088
lea ecx, [ebp - 0x2940]
call fcn.00489c74
mov dword [ebp - 0x8a4], 9
mov dword [ebp - 0x2ba0], 0x5af8b513
mov dword [ebp - 0x244c], 0xbea5223f
mov dword [ebp - 0x2ba8], 0xffffffff
mov dword [ebp - 0x2bb0], 0xb3a00d0e
mov dword [ebp - 0x2bb8], 4
mov dword [ebp - 0x1004], 1
mov dword [ebp - 0x89c], 0
jmp 0x488c37
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 3
jge 0x488c53
mov eax, dword [ebp - 0x89c]
mov dword [ebp + eax*4 - 0x3568], 0xffffffff
jmp 0x488c2a
mov dword [ebp - 0x8a4], 0
jmp 0x488c6c
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 5
jne 0x488dcf
mov dword [ebp - 0x24c], 0
jmp 0x488c92
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x488cae
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x33f8], 0
jmp 0x488c85
mov dword [ebp - 0x24c], 0
jmp 0x488cc7
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x488ce3
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x2744], 0
jmp 0x488cba
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2744], 0
jmp 0x488d0e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2744]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2744], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2744], 2
jg 0x488dca
mov dword [ebp - 0x8ac], 1
mov dword [ebp - 0x2bc0], 0x2ca8cda2
mov dword [ebp - 0x8ac], 0
jmp 0x488d4e
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 2
jg 0x488dc5
mov dword [ebp - 0x8b4], 0
jmp 0x488d70
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 2
jge 0x488d8c
mov eax, dword [ebp - 0x8b4]
mov dword [ebp + eax*4 - 0x2968], 0
jmp 0x488d63
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2968]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2968], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2744]
mov eax, dword [ebp + eax*4 - 0x33f8]
mov dword [ebp - 0x244c], eax
jmp 0x488d41
jmp 0x488cf5
jmp 0x488c5f
mov eax, dword [ebp - 0x1004]
inc eax
mov dword [ebp - 0x1004], eax
push 0
push 0
push 0
lea eax, [ebp - 0x3704]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4890fd
push 0
push 0
push 0x10
push dword [ebp - 0xbc0]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2454], 0xfffffffd
mov dword [ebp - 0x1d8], 0
jmp 0x488e2c
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x488e48
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x9d4], 9
jmp 0x488e1f
mov dword [ebp - 0x1d8], 0
jmp 0x488e61
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x488e7d
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x3410], 0xe22401db
jmp 0x488e54
mov byte [ebp - 0x3e7], 0
movzx eax, byte [ebp - 0x3e7]
test eax, eax
je 0x488e9c
push 0x12e5
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9d4], 0
je 0x488ec7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9d4], 0
je 0x488ec7
mov dword [ebp - 0x100c], 1
jmp 0x488ece
and dword [ebp - 0x100c], 0
cmp dword [ebp - 0x100c], 0xa17d0b0a
jae 0x488ee6
mov dword [ebp - 0x1014], 1
jmp 0x488eed
and dword [ebp - 0x1014], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9d4]
cmp eax, dword [ebp - 0x1014]
jge 0x488f0d
mov dword [ebp - 0x101c], 1
jmp 0x488f14
and dword [ebp - 0x101c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
imul eax, dword [ebp - 0x101c]
test eax, eax
je 0x488f3a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9d4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9d4], 2
je 0x488f56
mov dword [ebp - 0x1024], 1
jmp 0x488f5d
and dword [ebp - 0x1024], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1024]
neg ecx
cmp dword [ebp + eax - 0x9d4], ecx
jg 0x488f80
mov dword [ebp - 0x102c], 1
jmp 0x488f87
and dword [ebp - 0x102c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
add eax, dword [ebp - 0x102c]
cmp eax, 0xf144
jg 0x488fad
mov dword [ebp - 0x1034], 1
jmp 0x488fb4
and dword [ebp - 0x1034], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
imul eax, dword [ebp - 0x1034]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x9d4]
jg 0x488fe3
mov dword [ebp - 0x103c], 1
jmp 0x488fea
and dword [ebp - 0x103c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x103c]
mov dword [ebp + eax - 0x3410], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9d4]
mov dword [ebp - 0x2bc8], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9d4]
cmp dword [ebp + eax - 0x9d4], ecx
jne 0x489037
mov dword [ebp - 0x1044], 1
jmp 0x48903e
and dword [ebp - 0x1044], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
imul eax, dword [ebp - 0x1044]
test eax, eax
jl 0x489062
mov dword [ebp - 0x104c], 1
jmp 0x489069
and dword [ebp - 0x104c], 0
cmp dword [ebp - 0x104c], 0xdfe9
je 0x489081
mov dword [ebp - 0x1054], 1
jmp 0x489088
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x2454], eax
lea ecx, [ebp - 0x2940]
call fcn.00470023
mov dword [ebp - 0x2bd0], 0xeac8b13e
mov byte [ebp - 0x3c0], 0
movzx eax, byte [ebp - 0x3c0]
test eax, eax
je 0x4890ce
push 0
push 0
push 0x231f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov byte [ebp - 0x3db], 0
movzx eax, byte [ebp - 0x3db]
test eax, eax
je 0x4890f6
push 0x3d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
jmp 0x4890fd
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x680], 0x2466e9f0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2bd8], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
jle 0x48912b
mov dword [ebp - 0x105c], 1
jmp 0x489132
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x105c], eax
je 0x489149
mov dword [ebp - 0x1064], 1
jmp 0x489150
and dword [ebp - 0x1064], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x1064], eax
jl 0x489167
mov dword [ebp - 0x106c], 1
jmp 0x48916e
and dword [ebp - 0x106c], 0
cmp dword [ebp - 0x106c], 0
jne 0x489186
cmp dword [ebp - 0x78], 0
jne 0x489186
mov eax, 0x6fd4
test eax, eax
je 0x48919b
cmp dword [ebp - 0x680], 0
je 0x48919b
mov dword [ebp - 0x1074], 1
jmp 0x4891a2
and dword [ebp - 0x1074], 0
mov eax, dword [ebp - 0x1074]
sub eax, dword [ebp - 0x680]
jne 0x4891b7
cmp dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0x78], eax
jge 0x4891ce
mov dword [ebp - 0x107c], 1
jmp 0x4891d5
and dword [ebp - 0x107c], 0
cmp dword [ebp - 0x107c], 0
jae 0x4891ea
mov dword [ebp - 0x1084], 1
jmp 0x4891f1
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
sub ecx, dword [ebp - 0x1084]
sub eax, ecx
je 0x489216
cmp dword [ebp - 0x680], 0
je 0x489216
mov dword [ebp - 0x108c], 1
jmp 0x48921d
and dword [ebp - 0x108c], 0
mov eax, dword [ebp - 0x108c]
sub eax, 0x580b15ec
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
jmp 0x48923b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x18
jge 0x48925f
mov byte [ebp - 0x2be], 0
movzx eax, byte [ebp - 0x2be]
test eax, eax
je 0x48925d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x489234
lea ecx, [ebp - 0x2940]
call fcn.00470018
jmp 0x489a36
pop edi
pop esi
mov esp, ebp
pop ebp
ret