Function at 0x46f995
Capabilities:
Allocate thread local storage
Check for time delay via gettickcount
Check os version
Delete registry key
Delete registry value
Enumerate gui resources
Get disk information
Get file size
Get geographical location
Hide graphical window
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3644
call fcn.004a5d40
push esi
push edi
push 1
lea ecx, [ebp - 0x1f84]
call fcn.00434f0f
mov dword [ebp - 0x180], 0
jmp 0x46f9ca
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x46f9e6
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x930], 0x624039b
jmp 0x46f9bd
mov dword [ebp - 0x180], 0
jmp 0x46f9ff
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x46fa21
push dword [ebp - 0x180]
lea ecx, [ebp - 0x1f84]
call fcn.00434ffd
mov dword [eax], 0xfffffffd
jmp 0x46f9f2
mov byte [ebp - 0x27f], 0
movzx eax, byte [ebp - 0x27f]
test eax, eax
je 0x46fa3b
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
lea ecx, [ebp - 0x1f84]
call fcn.00434ffd
and dword [eax], 0
jmp 0x46fa71
push 0
lea ecx, [ebp - 0x1f84]
call fcn.00434ffd
mov dword [ebp - 0x1634], eax
mov eax, dword [ebp - 0x1634]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1634]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1f84]
call fcn.00434ffd
cmp dword [eax], 0
jg 0x46faeb
mov dword [ebp - 0x440], 2
mov dword [ebp - 0x440], 0
jmp 0x46faa6
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0
jg 0x46facb
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x440]
mov eax, dword [ebp + eax*4 - 0x930]
mov dword [ebp + ecx*4 - 0x930], eax
jmp 0x46fa99
push 0
lea ecx, [ebp - 0x1f84]
call fcn.00434ffd
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x930], 0
je 0x46fae6
jmp 0x46faeb
jmp 0x46fa4d
lea ecx, [ebp - 0x1f84]
call fcn.00434fe1
mov dword [ebp - 0x2608], 0x2d5e48d3
mov dword [ebp - 0x2604], 0x2d5e48d3
mov dword [ebp - 0x2600], 0x2d5e48d3
mov dword [ebp - 0x25fc], 0x2d5e48d3
mov dword [ebp - 0x88], 0xf665683c
mov dword [ebp - 0x2058], 0x95c1f4ac
mov dword [ebp - 0x88], 0
jmp 0x46fb4b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jg 0x46fb68
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x2608], 0
je 0x46fb66
jmp 0x46fb68
jmp 0x46fb3e
mov dword [ebp - 0x88], 6
jmp 0x46fb81
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xa
jge 0x46ff4c
mov dword [ebp - 0xad8], 9
mov dword [ebp - 0x3e4], 0xffffffff
mov dword [ebp - 0x938], 0xade0980d
mov dword [ebp - 0x2008], 1
mov dword [ebp - 0x1d70], 0x766593c3
mov dword [ebp - 0xad8], 0x867b8f5f
cmp dword [ebp - 0xad8], 0
je 0x46ff3b
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x938], 0
jne 0x46fbfe
mov eax, 0x59c45c1d
test eax, eax
jne 0x46fbfe
and dword [ebp - 0x1d0c], 0
jmp 0x46fc08
mov dword [ebp - 0x1d0c], 1
mov eax, 0x36729694
test eax, eax
je 0x46fc26
cmp dword [ebp - 0x3e4], 0
je 0x46fc26
mov dword [ebp - 0x1d04], 1
jmp 0x46fc2d
and dword [ebp - 0x1d04], 0
cmp dword [ebp - 0x1d04], 0xb821342f
ja 0x46fc45
mov dword [ebp - 0x1d14], 1
jmp 0x46fc4c
and dword [ebp - 0x1d14], 0
mov eax, dword [ebp - 0x3e4]
imul eax, dword [ebp - 0x1d0c]
cmp eax, dword [ebp - 0x1d14]
je 0x46fc6d
mov dword [ebp - 0x1d1c], 1
jmp 0x46fc74
and dword [ebp - 0x1d1c], 0
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x1d1c]
jne 0x46fc8f
cmp dword [ebp - 0x88], 0
je 0x46ff3b
mov dword [ebp - 0x38c], 0x51b32e26
mov dword [ebp - 0x1d68], 0xe2c9bf5e
mov eax, dword [ebp - 0x38c]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x2608]
cmp eax, 0x80ee
je 0x46fcc9
mov dword [ebp - 0x1d24], 1
jmp 0x46fcd0
and dword [ebp - 0x1d24], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x1d24]
jle 0x46fcea
mov dword [ebp - 0x1d2c], 1
jmp 0x46fcf1
and dword [ebp - 0x1d2c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2608]
cmp dword [ebp - 0x1d2c], eax
je 0x46fd11
mov dword [ebp - 0x1d58], 1
jmp 0x46fd18
and dword [ebp - 0x1d58], 0
cmp dword [ebp - 0x1d58], 0x67b3
jne 0x46fd30
mov dword [ebp - 0x1d60], 1
jmp 0x46fd37
and dword [ebp - 0x1d60], 0
mov eax, dword [ebp - 0x1d60]
mov dword [ebp - 0x1d68], eax
mov dword [ebp - 0x3e4], 0
jmp 0x46fd5c
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0x26
jl 0x46ff39
push 2
lea ecx, [ebp - 0x2628]
call fcn.00434f0f
mov dword [ebp - 0x5ac], 0
jmp 0x46fd8f
mov eax, dword [ebp - 0x5ac]
inc eax
mov dword [ebp - 0x5ac], eax
cmp dword [ebp - 0x5ac], 2
jge 0x46fdb1
push dword [ebp - 0x5ac]
lea ecx, [ebp - 0x2628]
call fcn.00434ffd
mov dword [eax], 0xfffffff7
jmp 0x46fd82
cmp dword [ebp - 0x38c], 0
je 0x46fdc9
mov dword [ebp - 0x1d68], 0x687fd074
jmp 0x46ff0f
mov dword [ebp - 0x2050], 0x27438e21
mov dword [ebp - 0x38c], 0
jmp 0x46fdec
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 3
jg 0x46fe1b
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebp - 0x2b0]
test eax, eax
je 0x46fe19
push 0x1741
push 0x1886
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x46fddf
cmp dword [ebp - 0x88], 0
je 0x46fe40
mov eax, dword [ebp - 0x2008]
neg eax
mov dword [ebp - 0x1d70], eax
je 0x46fe40
mov dword [ebp - 0x1d78], 1
jmp 0x46fe47
and dword [ebp - 0x1d78], 0
cmp dword [ebp - 0x1d78], 1
ja 0x46fe5c
mov dword [ebp - 0x1d80], 1
jmp 0x46fe63
and dword [ebp - 0x1d80], 0
mov eax, dword [ebp - 0x2050]
cmp dword [ebp - 0x1d80], eax
jge 0x46fe7d
mov dword [ebp - 0x1d88], 1
jmp 0x46fe84
and dword [ebp - 0x1d88], 0
push 1
lea ecx, [ebp - 0x2628]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1d88]
cmp ecx, dword [eax]
jge 0x46fea7
mov dword [ebp - 0x1d90], 1
jmp 0x46feae
and dword [ebp - 0x1d90], 0
push 1
lea ecx, [ebp - 0x2628]
call fcn.00434ffd
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1d90]
jl 0x46fed1
mov dword [ebp - 0x1d98], 1
jmp 0x46fed8
and dword [ebp - 0x1d98], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2608]
add eax, dword [ebp - 0x1d98]
cmp eax, 3
jle 0x46fefc
mov dword [ebp - 0x1da0], 1
jmp 0x46ff03
and dword [ebp - 0x1da0], 0
mov eax, dword [ebp - 0x1da0]
mov dword [ebp - 0x938], eax
mov byte [ebp - 0x2b2], 0
movzx eax, byte [ebp - 0x2b2]
test eax, eax
je 0x46ff29
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [ebp - 0x2628]
call fcn.00434fe1
jmp 0x46fd4f
jmp 0x46ff47
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2058], eax
jmp 0x46fb74
mov dword [ebp - 8], 0x2e91a04
mov dword [ebp - 0x2f1c], 0x6c08385
mov dword [ebp - 8], 0xfffffff9
jmp 0x46ff6d
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff8
jl 0x46ffcf
mov dword [ebp - 0x450], 0x22124f84
mov dword [ebp - 0x1da8], 0
mov dword [ebp - 0x450], 0xe
jmp 0x46ffa0
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0xb
jg 0x46ffcd
mov dword [ebp - 0x2060], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x1da8], eax
mov eax, dword [ebp - 0x1da8]
mov dword [ebp - 0x2060], eax
jmp 0x46ff93
jmp 0x46ff66
cmp dword [ebp - 8], 0
je 0x470135
mov dword [ebp - 0x2078], 0xfffffffc
mov dword [ebp - 0x744], 0
jmp 0x46fffc
mov eax, dword [ebp - 0x744]
inc eax
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 1
jge 0x470018
mov eax, dword [ebp - 0x744]
mov dword [ebp + eax*4 - 0x414], 0xc54c9751
jmp 0x46ffef
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x414]
cmp dword [ebp - 8], eax
je 0x470036
mov dword [ebp - 0x1db0], 1
jmp 0x47003d
and dword [ebp - 0x1db0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x414]
cmp dword [ebp - 0x1db0], eax
je 0x470064
cmp dword [ebp - 8], 0
je 0x470064
mov dword [ebp - 0x2068], 1
jmp 0x47006b
and dword [ebp - 0x2068], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x414]
cmp dword [ebp - 8], eax
je 0x470089
mov dword [ebp - 0x1db8], 1
jmp 0x470090
and dword [ebp - 0x1db8], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1db8], eax
jne 0x4700a7
mov dword [ebp - 0x2070], 1
jmp 0x4700ae
and dword [ebp - 0x2070], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2078]
cmp dword [ebp + eax - 0x414], ecx
jl 0x4700cf
mov dword [ebp - 0x1dc0], 1
jmp 0x4700d6
and dword [ebp - 0x1dc0], 0
cmp dword [ebp - 0x1dc0], 0xaf86f25d
jb 0x4700ee
mov dword [ebp - 0x1dc8], 1
jmp 0x4700f5
and dword [ebp - 0x1dc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x414]
cmp dword [ebp - 0x1dc8], eax
jge 0x470116
mov dword [ebp - 0x1dd0], 1
jmp 0x47011d
and dword [ebp - 0x1dd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1dd0]
mov dword [ebp + eax - 0x414], ecx
jmp 0x4703d7
mov dword [ebp - 0xb10], 0
mov dword [ebp - 0x940], 0x51162d50
push 2
lea ecx, [ebp - 0x2634]
call fcn.00434f0f
mov dword [ebp - 0xa54], 0xd47cdd53
mov dword [ebp - 0x5b4], 0
jmp 0x470179
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 2
jge 0x470198
push dword [ebp - 0x5b4]
lea ecx, [ebp - 0x2634]
call fcn.00434ffd
or dword [eax], 0xffffffff
jmp 0x47016c
cmp dword [ebp - 0xb10], 0
jne 0x470308
mov eax, dword [ebp - 8]
mov dword [ebp - 0x310c], eax
mov eax, 0xab6a
test eax, eax
je 0x4701cf
push 0
lea ecx, [ebp - 0x2634]
call fcn.00434ffd
cmp dword [eax], 0
je 0x4701cf
cmp dword [ebp - 8], 0
jne 0x4701e3
push 2
pop eax
test eax, eax
jne 0x4701e3
xor eax, eax
jne 0x4701e3
and dword [ebp - 0x1dd8], 0
jmp 0x4701ed
mov dword [ebp - 0x1dd8], 1
mov eax, dword [ebp - 0x1dd8]
neg eax
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0xa54], eax
jne 0x470212
mov dword [ebp - 0x2080], 1
jmp 0x470219
and dword [ebp - 0x2080], 0
mov eax, 0xffff
test eax, eax
jne 0x47023d
push 1
lea ecx, [ebp - 0x2634]
call fcn.00434ffd
cmp dword [eax], 0
jne 0x47023d
and dword [ebp - 0x2088], 0
jmp 0x470247
mov dword [ebp - 0x2088], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e08], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3240], eax
or eax, 0xffffffff
cmp eax, 0xae26
jg 0x47026f
mov dword [ebp - 0x2090], 1
jmp 0x470276
and dword [ebp - 0x2090], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2e10], eax
cmp dword [ebp - 8], 0
jl 0x47028e
mov eax, 0xce6
test eax, eax
jne 0x4702a0
cmp dword [ebp - 0xa54], 0
jne 0x4702a0
and dword [ebp - 0x1de0], 0
jmp 0x4702aa
mov dword [ebp - 0x1de0], 1
cmp dword [ebp - 0x1de0], 0x4a53e8af
jge 0x4702c2
mov dword [ebp - 0x1de8], 1
jmp 0x4702c9
and dword [ebp - 0x1de8], 0
mov eax, dword [ebp - 0x940]
cmp eax, dword [ebp - 0x1de8]
jle 0x4702e3
mov dword [ebp - 0x1df0], 1
jmp 0x4702ea
and dword [ebp - 0x1df0], 0
mov eax, dword [ebp - 0x1df0]
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 0
jne 0x470308
and dword [ebp - 0x1df8], 0
jmp 0x470312
mov dword [ebp - 0x1df8], 1
imul eax, dword [ebp - 0x1df8], 0xeae2
cmp eax, 0x47ebdcf2
jge 0x47033c
mov dword [ebp - 0x1e00], 5
mov eax, dword [ebp - 0x1e00]
inc eax
mov dword [ebp - 0x1e00], eax
jmp 0x4703a2
mov dword [ebp - 8], 0
jmp 0x47034c
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff1
jle 0x4703a2
mov byte [ebp - 0x2b4], 0
movzx eax, byte [ebp - 0x2b4]
test eax, eax
je 0x4703a0
push 0x14f8
push 0x17a7
push 0xef9
push 0x6f0
push 0x24ab
push 0xb15
push 0xdf
push 0x1d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x470345
mov eax, dword [ebp - 0xb10]
cmp dword [ebp - 0xb10], eax
jge 0x4703bc
mov dword [ebp - 0x1e50], 1
jmp 0x4703c3
and dword [ebp - 0x1e50], 0
mov eax, dword [ebp - 0x1e50]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x2634]
call fcn.00434fe1
push 1
lea ecx, [ebp - 0x1f54]
call fcn.00434f0f
mov dword [ebp - 0x184], 0x9b55bb2c
push 1
lea ecx, [ebp - 0x2abc]
call fcn.00434f0f
mov dword [ebp - 0x19d8], 0x21c3a23f
mov dword [ebp - 0x820], 0
jmp 0x47041e
mov eax, dword [ebp - 0x820]
inc eax
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 1
jge 0x470440
push dword [ebp - 0x820]
lea ecx, [ebp - 0x2abc]
call fcn.00434ffd
mov dword [eax], 0x8bd4dfbd
jmp 0x470411
mov dword [ebp - 0x184], 0xffffffff
jmp 0x470459
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x15
jl 0x470598
mov dword [ebp - 0x5bc], 0xa2282d56
mov dword [ebp - 0x2098], 9
cmp dword [ebp - 0x5bc], 0
je 0x470513
imul eax, dword [ebp - 0x184], 0xf88d
test eax, eax
jne 0x4704a7
cmp dword [ebp - 0x5bc], 0
jne 0x4704a7
and dword [ebp - 0x1e58], 0
jmp 0x4704b1
mov dword [ebp - 0x1e58], 1
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1e58], eax
jle 0x4704d4
cmp dword [ebp - 0x5bc], 0
je 0x4704d4
mov dword [ebp - 0x1e1c], 1
jmp 0x4704db
and dword [ebp - 0x1e1c], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x1e1c], eax
je 0x4704f5
mov dword [ebp - 0x19d0], 1
jmp 0x4704fc
and dword [ebp - 0x19d0], 0
push 4
pop eax
sub eax, dword [ebp - 0x19d0]
je 0x470513
mov dword [ebp - 0xbd0], 1
jmp 0x47051a
and dword [ebp - 0xbd0], 0
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0xbd0]
cmp eax, dword [ebp - 0x5bc]
jle 0x47053a
mov dword [ebp - 0xbd8], 1
jmp 0x470541
and dword [ebp - 0xbd8], 0
push 0
lea ecx, [ebp - 0x2abc]
call fcn.00434ffd
mov dword [eax], 5
mov dword [ebp - 0x19d8], 5
mov eax, dword [ebp - 0x19d8]
neg eax
add eax, dword [ebp - 0xbd8]
cmp eax, dword [ebp - 0x184]
jle 0x470580
mov dword [ebp - 0x19e0], 1
jmp 0x470587
and dword [ebp - 0x19e0], 0
mov eax, dword [ebp - 0x19e0]
mov dword [ebp - 0x2098], eax
jmp 0x47044c
lea ecx, [ebp - 0x2abc]
call fcn.00434fe1
mov dword [ebp - 0x94], 0x68ec0ae9
mov dword [ebp - 0x4d8], 0x9c4ddb84
mov dword [ebp - 0xbf0], 0xffffffff
mov dword [ebp - 0x94], 0
jmp 0x4705da
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x4705ff
mov byte [ebp - 0x2b6], 0
movzx eax, byte [ebp - 0x2b6]
test eax, eax
je 0x4705fd
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x4705cd
cmp dword [ebp - 0x94], 0
jne 0x470674
cmp dword [ebp - 0x94], 0
je 0x470650
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], eax
jne 0x47062b
mov dword [ebp - 0xbe0], 1
jmp 0x470632
and dword [ebp - 0xbe0], 0
imul eax, dword [ebp - 0xbe0], 0xfffffff9
test eax, eax
je 0x470650
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x470650
mov dword [ebp - 0x19e8], 1
jmp 0x470657
and dword [ebp - 0x19e8], 0
mov eax, dword [ebp - 0x19e8]
sub eax, 7
imul eax, dword [ebp - 0x94]
test eax, eax
jne 0x470674
and dword [ebp - 0xbe8], 0
jmp 0x47067e
mov dword [ebp - 0xbe8], 1
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0xbe8]
je 0x4706a1
cmp dword [ebp - 0x94], 0
je 0x4706a1
mov dword [ebp - 0x19f0], 1
jmp 0x4706a8
and dword [ebp - 0x19f0], 0
mov eax, dword [ebp - 0x19f0]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x94], eax
jge 0x4706ce
mov dword [ebp - 0x20a0], 1
jmp 0x4706d5
and dword [ebp - 0x20a0], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x3114], eax
imul eax, dword [ebp - 0x4d8], 0x869b
add eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0xbf0]
jl 0x470705
mov dword [ebp - 0x19f8], 1
jmp 0x47070c
and dword [ebp - 0x19f8], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x19f8], eax
jne 0x470726
mov dword [ebp - 0xbf8], 1
jmp 0x47072d
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x100], 0
jmp 0x470752
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x47076e
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x968], 0x624039b
jmp 0x470745
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x394], 0xfffffff8
mov dword [ebp - 0x74c], 0
jmp 0x47079b
mov eax, dword [ebp - 0x74c]
inc eax
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 4
jge 0x4707b7
mov eax, dword [ebp - 0x74c]
mov dword [ebp + eax*4 - 0x2b34], 0xffff
jmp 0x47078e
mov dword [ebp - 0x230], 0
jmp 0x4707d0
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xffffffe9
je 0x470d44
mov dword [ebp - 0xa4], 0xc3c69aed
push 1
lea ecx, [ebp - 0x1f60]
call fcn.00434f0f
mov dword [ebp - 0x5c4], 0
jmp 0x47080d
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x5c4], 1
jge 0x47082c
push dword [ebp - 0x5c4]
lea ecx, [ebp - 0x1f60]
call fcn.00434ffd
and dword [eax], 0
jmp 0x470800
mov dword [ebp - 0xa4], 3
jmp 0x470845
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x4708a8
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x814], 3
jmp 0x470871
mov eax, dword [ebp - 0x814]
dec eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
jl 0x470894
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebp - 0x2b8]
test eax, eax
je 0x470892
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x470864
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0x2b34], 0
je 0x4708a6
jmp 0x470838
jmp 0x470838
mov dword [ebp - 0xa4], 0
jmp 0x4708c1
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffee
jle 0x470d34
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x1a00], 0x37b30477
mov dword [ebp - 0x458], 1
mov dword [ebp - 0x21f4], 0xffff
mov dword [ebp - 0x21fc], 0x56723ff4
mov dword [ebp - 0x2204], 0xccce
mov dword [ebp - 0x4c], 3
jmp 0x470917
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x470d2f
mov dword [ebp - 0x1a08], 0xfffffff6
mov dword [ebp - 0xc10], 0
mov dword [ebp - 0x1a28], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x4c], eax
jle 0x470956
mov dword [ebp - 0xc00], 1
jmp 0x47095d
and dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x1a00], eax
mov eax, dword [ebp - 0x1a00]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x2e18], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x32f8], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2e20], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x311c], eax
cmp dword [ebp - 0x1a08], 0
jne 0x4709e3
cmp dword [ebp - 0x4c], 0
jne 0x4709e3
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x2b34], 0
jne 0x4709e3
xor eax, eax
jne 0x4709e3
mov eax, 0x8e54
test eax, eax
jne 0x4709e3
and dword [ebp - 0x20a8], 0
jmp 0x4709ed
mov dword [ebp - 0x20a8], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2e28], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x3254], eax
mov eax, dword [ebp - 0x1a08]
cmp dword [ebp - 0x4c], eax
jne 0x470a19
mov dword [ebp - 0xc08], 1
jmp 0x470a20
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xc08]
neg eax
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x2b34]
mov ecx, 0xd777
sub ecx, eax
cmp ecx, 0xa81f
jl 0x470a4f
mov dword [ebp - 0x1a10], 1
jmp 0x470a56
and dword [ebp - 0x1a10], 0
mov eax, dword [ebp - 0x1a10]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0xc10]
sub eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp + ecx*4 - 0x2b34], eax
je 0x470a83
mov dword [ebp - 0x1a18], 1
jmp 0x470a8a
and dword [ebp - 0x1a18], 0
cmp dword [ebp - 0x1a18], 0xfffffffb
jg 0x470a9f
mov dword [ebp - 0xc18], 1
jmp 0x470aa6
and dword [ebp - 0xc18], 0
cmp dword [ebp - 0xc18], 0xfffffffe
je 0x470abb
mov dword [ebp - 0x1a20], 1
jmp 0x470ac2
and dword [ebp - 0x1a20], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1a20], eax
je 0x470ad9
mov dword [ebp - 0xc20], 1
jmp 0x470ae0
and dword [ebp - 0xc20], 0
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0x1a28], eax
cmp dword [ebp - 0x1a28], 0
jne 0x470b02
xor eax, eax
jne 0x470b02
and dword [ebp - 0xc28], 0
jmp 0x470b0c
mov dword [ebp - 0xc28], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xc28], eax
jle 0x470b29
cmp dword [ebp - 0x21f4], 0
jne 0x470b29
and dword [ebp - 0x1a30], 0
jmp 0x470b33
mov dword [ebp - 0x1a30], 1
cmp dword [ebp - 0x1a30], 0xfff9
jb 0x470b4b
mov dword [ebp - 0xc30], 1
jmp 0x470b52
and dword [ebp - 0xc30], 0
push 0
lea ecx, [ebp - 0x1f60]
call fcn.00434ffd
mov ecx, dword [ebp - 0xc30]
mov dword [eax], ecx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x2e30], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x3124], eax
push 0
lea ecx, [ebp - 0x1f60]
call fcn.00434ffd
mov esi, eax
push 0
lea ecx, [ebp - 0x1f60]
call fcn.00434ffd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x470bad
mov dword [ebp - 0x1a38], 1
jmp 0x470bb4
and dword [ebp - 0x1a38], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x1a38], eax
jg 0x470bce
mov dword [ebp - 0xc38], 1
jmp 0x470bd5
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x458]
imul eax, dword [ebp - 0xc38]
cmp eax, dword [ebp - 0xa4]
jl 0x470bf6
mov dword [ebp - 0x948], 1
jmp 0x470bfd
and dword [ebp - 0x948], 0
push 0
lea ecx, [ebp - 0x1f60]
call fcn.00434ffd
mov ecx, dword [ebp - 0x948]
mov dword [eax], ecx
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x948], eax
jg 0x470c2c
mov dword [ebp - 0x1a40], 1
jmp 0x470c33
and dword [ebp - 0x1a40], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1a40], eax
jle 0x470c4a
mov dword [ebp - 0xc40], 1
jmp 0x470c51
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0xc40], 0x6967
jne 0x470c69
mov dword [ebp - 0x1a48], 1
jmp 0x470c70
and dword [ebp - 0x1a48], 0
mov eax, dword [ebp - 0x21fc]
cmp dword [ebp - 0x1a48], eax
jg 0x470c8a
mov dword [ebp - 0xc48], 1
jmp 0x470c91
and dword [ebp - 0xc48], 0
cmp dword [ebp - 0xc48], 0x76463a47
jl 0x470ca9
mov dword [ebp - 0x1a50], 1
jmp 0x470cb0
and dword [ebp - 0x1a50], 0
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0x1a50], eax
jne 0x470cca
mov dword [ebp - 0xc50], 1
jmp 0x470cd1
and dword [ebp - 0xc50], 0
mov eax, dword [ebp - 0xc50]
sub eax, dword [ebp - 0x2204]
add eax, dword [ebp - 0x394]
jne 0x470cf3
or eax, 0xffffffff
jne 0x470cf3
and dword [ebp - 0x1a58], 0
jmp 0x470cfd
mov dword [ebp - 0x1a58], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1a58], eax
jle 0x470d17
mov dword [ebp - 0xc58], 1
jmp 0x470d1e
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0x458], eax
jmp 0x470910
jmp 0x4708b4
lea ecx, [ebp - 0x1f60]
call fcn.00434fe1
jmp 0x4707c3
mov byte [ebp - 0x2ba], 0
movzx eax, byte [ebp - 0x2ba]
test eax, eax
je 0x470d5e
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x100], 0
jmp 0x470d77
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x470d99
push dword [ebp - 0x100]
lea ecx, [ebp - 0x1f54]
call fcn.00434ffd
mov dword [eax], 0xfffffffd
jmp 0x470d6a
mov dword [ebp - 0x524], 0x68206240
mov dword [ebp - 0x220c], 0xffff
mov dword [ebp - 0x2e38], 0xf8067e30
mov dword [ebp - 0x524], 7
jmp 0x470dd0
mov eax, dword [ebp - 0x524]
dec eax
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x524], 1
jge 0x470dff
mov byte [ebp - 0x2bc], 0
movzx eax, byte [ebp - 0x2bc]
test eax, eax
je 0x470dfd
push 0xa0a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x470dc3
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x220c], eax
mov dword [ebp - 0x200], 0x36ccb036
mov dword [ebp - 0x3298], 0xd21dfe4
mov dword [ebp - 0x1a60], 0xffff
mov dword [ebp - 0x222c], 0xfffd
mov dword [ebp - 0x11c], 0
jmp 0x470e4c
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x470e68
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x3ec], 0
jmp 0x470e3f
mov dword [ebp - 0x11c], 0
jmp 0x470e81
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x470e9d
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x3364], 0xffffffff
jmp 0x470e74
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3ec], 0
jmp 0x470ecb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ec], 0xffffffec
jle 0x470f64
mov dword [ebp - 0x2214], 0
mov dword [ebp - 0x221c], 7
push 2
lea ecx, [ebp - 0x2f38]
call fcn.00434f0f
mov dword [ebp - 0x5cc], 0
jmp 0x470f19
mov eax, dword [ebp - 0x5cc]
inc eax
mov dword [ebp - 0x5cc], eax
cmp dword [ebp - 0x5cc], 2
jge 0x470f3b
push dword [ebp - 0x5cc]
lea ecx, [ebp - 0x2f38]
call fcn.00434ffd
mov dword [eax], 0xdb85613
jmp 0x470f0c
mov eax, dword [ebp - 0x2214]
mov dword [ebp - 0x221c], eax
mov eax, dword [ebp - 0x1a60]
dec eax
mov dword [ebp - 0x1a60], eax
lea ecx, [ebp - 0x2f38]
call fcn.00434fe1
jmp 0x470eb0
mov dword [ebp - 0x200], 0
jmp 0x470f7d
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x1b
jge 0x471219
mov dword [ebp - 0x460], 0x10e6b6cd
mov dword [ebp - 0x1a70], 1
mov dword [ebp - 0xa5c], 1
mov byte [ebp - 0x2be], 0
movzx eax, byte [ebp - 0x2be]
test eax, eax
je 0x470fc4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x2e40], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3364]
mov dword [ebp - 0xc60], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xc60]
mov dword [ebp + eax - 0x3364], ecx
cmp dword [ebp - 0xc60], 0
je 0x4710b7
mov eax, 0x4ed383de
test eax, eax
je 0x471013
cmp dword [ebp - 0x460], 0
mov eax, 0x8f1e
test eax, eax
je 0x471031
cmp dword [ebp - 0x200], 0
je 0x471031
mov dword [ebp - 0x1a68], 1
jmp 0x471038
and dword [ebp - 0x1a68], 0
cmp dword [ebp - 0x1a68], 1
jle 0x47104d
mov dword [ebp - 0x2224], 1
jmp 0x471054
and dword [ebp - 0x2224], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
mov dword [ebp - 0x312c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
mov dword [ebp - 0x2e48], eax
cmp dword [ebp - 0x200], 0
je 0x47108f
mov dword [ebp - 0xc68], 1
jmp 0x471096
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0x1a70], eax
cmp dword [ebp - 0x1a70], 0
je 0x4710b7
mov dword [ebp - 0xc70], 1
jmp 0x4710be
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0x460]
add eax, dword [ebp - 0xa5c]
imul eax, dword [ebp - 0x460]
cmp eax, 1
jbe 0x471107
mov byte [ebp - 0x2c0], 0
movzx eax, byte [ebp - 0x2c0]
test eax, eax
je 0x471102
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x471214
mov dword [ebp - 0x1a88], 0xfffffffe
mov dword [ebp - 0x1a80], 0xfffffff8
mov dword [ebp - 0x4e0], 0xa1bab0c3
cmp dword [ebp - 0x4e0], 0
jne 0x471145
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0x4e0], eax
jge 0x471145
and dword [ebp - 0x1a78], 0
jmp 0x47114f
mov dword [ebp - 0x1a78], 1
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [ebp - 0x1a78]
add ecx, 0x71c2
add eax, ecx
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x4e0], eax
jne 0x471183
mov dword [ebp - 0xc78], 1
jmp 0x47118a
and dword [ebp - 0xc78], 0
mov dword [ebp - 0x1a80], 0
mov eax, dword [ebp - 0xc78]
add eax, 0x469bf966
cmp dword [ebp - 0x1a80], eax
jl 0x4711b3
mov dword [ebp - 0xc80], 1
jmp 0x4711ba
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0xa5c]
cmp dword [ebp - 0xc80], eax
je 0x4711d4
mov dword [ebp - 0xc88], 1
jmp 0x4711db
and dword [ebp - 0xc88], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1a88], eax
mov eax, dword [ebp - 0x1a88]
cmp eax, dword [ebp - 0xc88]
jge 0x471201
mov dword [ebp - 0x1a90], 1
jmp 0x471208
and dword [ebp - 0x1a90], 0
mov eax, dword [ebp - 0x1a90]
mov dword [ebp - 0x222c], eax
jmp 0x470f70
mov byte [ebp - 0x2c2], 0
mov dword [ebp - 0xe0], 0xfffffffa
mov dword [ebp - 0x1aa8], 0x6501874d
mov dword [ebp - 0x3268], 0xd580090a
mov dword [ebp - 0x2eac], 0x9e62b560
mov dword [ebp - 0x3168], 0xb870004d
mov dword [ebp - 0x2eb4], 6
push 2
lea ecx, [ebp - 0x2ad4]
call fcn.00434f0f
mov dword [ebp - 0x950], 0x57a2
mov dword [ebp - 0x32bc], 0x1e34f9a3
mov dword [ebp - 0x1bc], 0
jmp 0x471296
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 4
jge 0x4712b2
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x1f30], 1
jmp 0x471289
mov dword [ebp - 0x1bc], 0
jmp 0x4712cb
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x4712ed
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x2ad4]
call fcn.00434ffd
mov dword [eax], 0xdf78b15b
jmp 0x4712be
mov dword [ebp - 0xe0], 0
jmp 0x471306
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x471557
push 2
lea ecx, [ebp - 0x2640]
call fcn.00434f0f
mov dword [ebp - 0x754], 0
jmp 0x471339
mov eax, dword [ebp - 0x754]
inc eax
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 2
jge 0x47135b
push dword [ebp - 0x754]
lea ecx, [ebp - 0x2640]
call fcn.00434ffd
mov dword [eax], 0x3147f59e
jmp 0x47132c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f30]
mov dword [ebp - 0x2ebc], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x1f30], 1
je 0x47138a
mov dword [ebp - 0xc90], 1
jmp 0x471391
and dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x1f30]
cmp eax, dword [ebp - 0xc90]
jle 0x4713b2
mov dword [ebp - 0x1a98], 1
jmp 0x4713b9
and dword [ebp - 0x1a98], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x1f30]
cmp dword [ebp - 0x1a98], eax
jge 0x4713de
mov eax, dword [ebp - 0xe0]
cmp dword [ebp + eax*4 - 0x1f30], 0
jne 0x4713f7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f30], 0
jne 0x4713f7
and dword [ebp - 0xc98], 0
jmp 0x471401
mov dword [ebp - 0xc98], 1
cmp dword [ebp - 0xc98], 0xffffffff
jle 0x471416
mov dword [ebp - 0x1aa0], 1
jmp 0x47141d
and dword [ebp - 0x1aa0], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x1f30]
mov ecx, dword [ebp - 0x1aa0]
sub ecx, 0x4cf59275
sub eax, ecx
je 0x471455
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1f30], 0
je 0x471455
mov dword [ebp - 0xca0], 1
jmp 0x47145c
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0x1aa8], eax
cmp dword [ebp - 0x1aa8], 1
jne 0x47147d
mov dword [ebp - 0xca8], 1
jmp 0x471484
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x1f30]
mov dword [ebp - 0x3170], eax
mov eax, dword [ebp - 0x950]
inc eax
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x2ec4], eax
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x4714e2
push 0
lea ecx, [ebp - 0x2640]
call fcn.00434ffd
mov esi, eax
push 0
lea ecx, [ebp - 0x2640]
call fcn.00434ffd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x4714e2
and dword [ebp - 0x1ab0], 0
jmp 0x4714ec
mov dword [ebp - 0x1ab0], 1
mov eax, dword [ebp - 0xca8]
cmp eax, dword [ebp - 0x1ab0]
jge 0x471506
mov dword [ebp - 0xcb0], 1
jmp 0x47150d
and dword [ebp - 0xcb0], 0
cmp dword [ebp - 0xcb0], 0xdb0ff846
jbe 0x471525
mov dword [ebp - 0x1b1c], 1
jmp 0x47152c
and dword [ebp - 0x1b1c], 0
mov esi, dword [ebp - 0x1b1c]
sub esi, 0x5cec
push 1
lea ecx, [ebp - 0x2ad4]
call fcn.00434ffd
mov dword [eax], esi
lea ecx, [ebp - 0x2640]
call fcn.00434fe1
jmp 0x4712f9
lea ecx, [ebp - 0x2ad4]
call fcn.00434fe1
movzx eax, byte [ebp - 0x2c2]
test eax, eax
je 0x471987
mov dword [ebp - 0x258], 0x36ccb036
mov dword [ebp - 0x32a4], 0xd21dfe4
mov dword [ebp - 0xcb8], 0xffff
mov dword [ebp - 0x224c], 0xfffd
mov dword [ebp - 0x124], 0
jmp 0x4715b2
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x4715ce
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x39c], 0
jmp 0x4715a5
mov dword [ebp - 0x124], 0
jmp 0x4715e7
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x471603
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x33a4], 0xffffffff
jmp 0x4715da
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x39c], 0
jmp 0x471631
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x39c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x39c], 0xffffffec
jle 0x4716ca
mov dword [ebp - 0x2234], 0
mov dword [ebp - 0x223c], 7
push 2
lea ecx, [ebp - 0x2f48]
call fcn.00434f0f
mov dword [ebp - 0x5d4], 0
jmp 0x47167f
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x5d4], eax
cmp dword [ebp - 0x5d4], 2
jge 0x4716a1
push dword [ebp - 0x5d4]
lea ecx, [ebp - 0x2f48]
call fcn.00434ffd
mov dword [eax], 0xdb85613
jmp 0x471672
mov eax, dword [ebp - 0x2234]
mov dword [ebp - 0x223c], eax
mov eax, dword [ebp - 0xcb8]
dec eax
mov dword [ebp - 0xcb8], eax
lea ecx, [ebp - 0x2f48]
call fcn.00434fe1
jmp 0x471616
mov dword [ebp - 0x258], 0
jmp 0x4716e3
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x1b
jge 0x47197f
mov dword [ebp - 0x468], 0x10e6b6cd
mov dword [ebp - 0xcc8], 1
mov dword [ebp - 0xae0], 1
mov byte [ebp - 0x2c4], 0
movzx eax, byte [ebp - 0x2c4]
test eax, eax
je 0x47172a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x2ecc], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33a4]
mov dword [ebp - 0x1b24], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x1b24]
mov dword [ebp + eax - 0x33a4], ecx
cmp dword [ebp - 0x1b24], 0
je 0x47181d
mov eax, 0x4ed383de
test eax, eax
je 0x471779
cmp dword [ebp - 0x468], 0
mov eax, 0x8f1e
test eax, eax
je 0x471797
cmp dword [ebp - 0x258], 0
je 0x471797
mov dword [ebp - 0xcc0], 1
jmp 0x47179e
and dword [ebp - 0xcc0], 0
cmp dword [ebp - 0xcc0], 1
jle 0x4717b3
mov dword [ebp - 0x2244], 1
jmp 0x4717ba
and dword [ebp - 0x2244], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
mov dword [ebp - 0x3178], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
mov dword [ebp - 0x2ed4], eax
cmp dword [ebp - 0x258], 0
je 0x4717f5
mov dword [ebp - 0x1b2c], 1
jmp 0x4717fc
and dword [ebp - 0x1b2c], 0
mov eax, dword [ebp - 0x1b2c]
mov dword [ebp - 0xcc8], eax
cmp dword [ebp - 0xcc8], 0
je 0x47181d
mov dword [ebp - 0x1b34], 1
jmp 0x471824
and dword [ebp - 0x1b34], 0
mov eax, dword [ebp - 0x1b34]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x468]
add eax, dword [ebp - 0xae0]
imul eax, dword [ebp - 0x468]
cmp eax, 1
jbe 0x47186d
mov byte [ebp - 0x2c6], 0
movzx eax, byte [ebp - 0x2c6]
test eax, eax
je 0x471868
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x47197a
mov dword [ebp - 0xce0], 0xfffffffe
mov dword [ebp - 0xcd8], 0xfffffff8
mov dword [ebp - 0x520], 0xa1bab0c3
cmp dword [ebp - 0x520], 0
jne 0x4718ab
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x520], eax
jge 0x4718ab
and dword [ebp - 0xcd0], 0
jmp 0x4718b5
mov dword [ebp - 0xcd0], 1
mov eax, dword [ebp - 0x520]
mov ecx, dword [ebp - 0xcd0]
add ecx, 0x71c2
add eax, ecx
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x520], eax
jne 0x4718e9
mov dword [ebp - 0x1b3c], 1
jmp 0x4718f0
and dword [ebp - 0x1b3c], 0
mov dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0x1b3c]
add eax, 0x469bf966
cmp dword [ebp - 0xcd8], eax
jl 0x471919
mov dword [ebp - 0x1b44], 1
jmp 0x471920
and dword [ebp - 0x1b44], 0
mov eax, dword [ebp - 0xae0]
cmp dword [ebp - 0x1b44], eax
je 0x47193a
mov dword [ebp - 0x1b4c], 1
jmp 0x471941
and dword [ebp - 0x1b4c], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xce0], eax
mov eax, dword [ebp - 0xce0]
cmp eax, dword [ebp - 0x1b4c]
jge 0x471967
mov dword [ebp - 0xce8], 1
jmp 0x47196e
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0x224c], eax
jmp 0x4716d6
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0x86c], 0xfffffff9
push 2
lea ecx, [ebp - 0x2aec]
call fcn.00434f0f
mov dword [ebp - 0x4e8], 9
mov dword [ebp - 0x3300], 0xffffffff
mov dword [ebp - 0x18c], 0
jmp 0x4719cb
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x4719e7
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x3200], 0x540d
jmp 0x4719be
mov dword [ebp - 0x18c], 0
jmp 0x471a00
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x471a22
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x2aec]
call fcn.00434ffd
mov dword [eax], 0xfffffffe
jmp 0x4719f3
mov dword [ebp - 0x86c], 0
jmp 0x471a3b
mov eax, dword [ebp - 0x86c]
inc eax
mov dword [ebp - 0x86c], eax
cmp dword [ebp - 0x86c], 3
jg 0x471cc0
mov dword [ebp - 0x12c], 0xfffffffd
mov dword [ebp - 0x12c], 3
jmp 0x471a6b
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x471ad5
mov dword [ebp - 0x470], 0xffffffff
mov dword [ebp - 0x470], 0
jmp 0x471a97
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 3
jg 0x471ad3
mov byte [ebp - 0x2c8], 0
movzx eax, byte [ebp - 0x2c8]
test eax, eax
je 0x471abf
push 0xd11
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov eax, dword [ebp - 0x470]
cmp dword [ebp + eax*4 - 0x3200], 0
je 0x471ad1
jmp 0x471ad3
jmp 0x471a8a
jmp 0x471a5e
mov dword [ebp - 0x12c], 3
jmp 0x471aee
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x471cbb
mov dword [ebp - 0x478], 0x4f3d4e67
mov dword [ebp - 0x1b5c], 1
mov dword [ebp - 0x478], 3
jmp 0x471b28
mov eax, dword [ebp - 0x478]
dec eax
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jl 0x471cb6
mov dword [ebp - 0x2254], 2
push 0
lea ecx, [ebp - 0x2aec]
call fcn.00434ffd
or dword [eax], 0xffffffff
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x4e8], 0
jmp 0x471b72
mov eax, dword [ebp - 0x4e8]
inc eax
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 1
jg 0x471cb1
push 1
lea ecx, [ebp - 0x236c]
call fcn.00434f0f
mov dword [ebp - 0x5dc], 0
jmp 0x471ba5
mov eax, dword [ebp - 0x5dc]
inc eax
mov dword [ebp - 0x5dc], eax
cmp dword [ebp - 0x5dc], 1
jge 0x471bc7
push dword [ebp - 0x5dc]
lea ecx, [ebp - 0x236c]
call fcn.00434ffd
mov dword [eax], 0xfffffffb
jmp 0x471b98
push 0
lea ecx, [ebp - 0x236c]
call fcn.00434ffd
and dword [eax], 0
jmp 0x471bfd
push 0
lea ecx, [ebp - 0x236c]
call fcn.00434ffd
mov dword [ebp - 0x1b54], eax
mov eax, dword [ebp - 0x1b54]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b54]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x236c]
call fcn.00434ffd
cmp dword [eax], 3
jg 0x471c80
mov dword [ebp - 0x75c], 4
mov dword [ebp - 0x75c], 1
jmp 0x471c32
mov eax, dword [ebp - 0x75c]
dec eax
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0
jl 0x471c7b
mov eax, dword [ebp - 0x478]
mov eax, dword [ebp + eax*4 - 0x3200]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xcf0]
mov dword [ebp + eax*4 - 0x3200], ecx
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x1b5c], eax
mov eax, dword [ebp - 0x1b5c]
mov dword [ebp - 0x2254], eax
jmp 0x471c25
jmp 0x471bd9
mov byte [ebp - 0x2ca], 0
movzx eax, byte [ebp - 0x2ca]
test eax, eax
je 0x471ca1
push 0x38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
lea ecx, [ebp - 0x236c]
call fcn.00434fe1
jmp 0x471b65
jmp 0x471b1b
jmp 0x471ae1
jmp 0x471a2e
lea ecx, [ebp - 0x2aec]
call fcn.00434fe1
push 0
lea ecx, [ebp - 0x1f54]
call fcn.00434ffd
and dword [eax], 0
jmp 0x471d01
push 0
lea ecx, [ebp - 0x1f54]
call fcn.00434ffd
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0xcf8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xcf8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1f54]
call fcn.00434ffd
cmp dword [eax], 0
jg 0x472b0a
push 1
lea ecx, [ebp - 0x2f68]
call fcn.00434f0f
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x28c4], 0x17d0b0a3
mov dword [ebp - 0x28c0], 0x17d0b0a3
mov dword [ebp - 0x28bc], 0x17d0b0a3
mov dword [ebp - 0x28b8], 0x17d0b0a3
lea ecx, [ebp - 0xb59]
call fcn.0043500c
push eax
lea eax, [ebp - 0x28b4]
push eax
lea eax, [ebp - 0x28c4]
push eax
lea ecx, [ebp - 0x353c]
call fcn.0043500f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2f58]
call fcn.00434fbb
mov dword [ebp - 0x2b5c], 0xf885bd52
mov dword [ebp - 0x5e4], 0
jmp 0x471dae
mov eax, dword [ebp - 0x5e4]
inc eax
mov dword [ebp - 0x5e4], eax
cmp dword [ebp - 0x5e4], 1
jge 0x471dd0
push dword [ebp - 0x5e4]
lea ecx, [ebp - 0x2f68]
call fcn.00434ffd
mov dword [eax], 1
jmp 0x471da1
mov dword [ebp - 0x81c], 0
jmp 0x471de9
mov eax, dword [ebp - 0x81c]
dec eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x81c], 0
jl 0x471ecf
mov dword [ebp - 0x5ec], 0
mov dword [ebp - 0x2b64], 5
mov dword [ebp - 0x2b6c], 0xcfd66c4a
mov dword [ebp - 0x2b74], 3
mov dword [ebp - 0x2b7c], 6
mov dword [ebp - 0x2b84], 0
mov dword [ebp - 0x2b8c], 0x95610a1
mov dword [ebp - 0x2264], 0x604491d0
mov dword [ebp - 0x5ec], 0
jmp 0x471e5f
mov eax, dword [ebp - 0x5ec]
dec eax
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x5ec], 0
jl 0x471eca
mov dword [ebp - 0x2b94], 0xffffffff
mov dword [ebp - 0x2b9c], 0xfffffff7
mov dword [ebp - 0x225c], 0x6d8bc0d1
mov dword [ebp - 0x2ba4], 0xffffffff
push 0
lea ecx, [ebp - 0x2f58]
call fcn.00434ffd
cmp dword [eax], 0
jl 0x471eae
mov dword [ebp - 0x1b64], 1
jmp 0x471eb5
and dword [ebp - 0x1b64], 0
mov eax, dword [ebp - 0x225c]
imul eax, dword [ebp - 0x1b64]
mov dword [ebp - 0x2264], eax
jmp 0x471e52
jmp 0x471ddc
lea ecx, [ebp - 0x2f58]
call fcn.00434fe1
lea ecx, [ebp - 0x2f68]
call fcn.00434fe1
mov dword [ebp - 0x42c], 2
mov dword [ebp - 0x764], 0x67e307b
mov dword [ebp - 0x958], 0xec4279c4
mov dword [ebp - 0xd00], 0xfffffff7
mov dword [ebp - 0xd08], 0xffffffff
mov dword [ebp - 0xd10], 0x6088b922
mov dword [ebp - 0x226c], 0
mov dword [ebp - 0xd20], 8
push 2
lea ecx, [ebp - 0x2b04]
call fcn.00434f0f
mov dword [ebp - 0x1e4], 0
jmp 0x471f5b
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x471f77
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x3214], 0xe9ab5c29
jmp 0x471f4e
mov dword [ebp - 0x1e4], 0
jmp 0x471f90
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x471fb2
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x2b04]
call fcn.00434ffd
mov dword [eax], 0xf4b3f4b1
jmp 0x471f83
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x958], 0
jne 0x47206f
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x2bac], eax
mov dword [ebp - 0xd00], 1
imul eax, dword [ebp - 0xd00], 0xffffffff
cmp eax, dword [ebp - 0x764]
jg 0x471ffc
mov dword [ebp - 0x1b6c], 1
jmp 0x472003
and dword [ebp - 0x1b6c], 0
mov eax, dword [ebp - 0x1b6c]
mov dword [ebp - 0xd08], eax
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0xd08], eax
jl 0x472029
mov dword [ebp - 0x1b74], 1
jmp 0x472030
and dword [ebp - 0x1b74], 0
mov eax, dword [ebp - 0x1b74]
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0xd10]
imul eax, dword [ebp - 0x764]
test eax, eax
jne 0x47206f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3214], 0
jne 0x47206f
mov eax, 0xb667f5ae
test eax, eax
jne 0x47206f
and dword [ebp - 0x1b7c], 0
jmp 0x472079
mov dword [ebp - 0x1b7c], 1
imul eax, dword [ebp - 0x1b7c], 0xcd97
mov dword [ebp - 0x226c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3214], 0xffff
jne 0x4720a8
mov dword [ebp - 0xd18], 1
jmp 0x4720af
and dword [ebp - 0xd18], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3214]
cmp dword [ebp - 0xd18], eax
jne 0x4720cf
mov dword [ebp - 0x1b84], 1
jmp 0x4720d6
and dword [ebp - 0x1b84], 0
mov eax, dword [ebp - 0x1b84]
mov dword [ebp - 0xd20], eax
mov esi, dword [ebp - 0xd20]
push 0
lea ecx, [ebp - 0x2b04]
call fcn.00434ffd
mov dword [eax], esi
lea ecx, [ebp - 0x2b04]
call fcn.00434fe1
push 1
lea ecx, [ebp - 0x1f48]
call fcn.00434f0f
mov dword [ebp - 0x960], 1
mov dword [ebp - 0x7c], 0
jmp 0x472129
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x472145
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x1f48]
call fcn.00434ffd
mov dword [eax], 0x4081c290
jmp 0x472122
mov dword [ebp - 0x7c], 0
jmp 0x472155
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x47216b
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xa64], 2
jmp 0x47214e
mov dword [ebp - 0x7c], 0
jmp 0x47217b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x472191
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x33d0], 1
jmp 0x472174
push 0
lea ecx, [ebp - 0x1f48]
call fcn.00434ffd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa64], 0
je 0x4721d0
push 0
lea ecx, [ebp - 0x1f48]
call fcn.00434ffd
cmp dword [ebp - 0x960], 0xffffffff
jle 0x4721d0
mov dword [ebp - 0x1b8c], 1
jmp 0x4721d7
and dword [ebp - 0x1b8c], 0
mov eax, dword [ebp - 0x1b8c]
neg eax
imul eax, dword [ebp - 0x960]
cmp eax, 0xfffffff7
jge 0x4721fd
mov eax, 0x69be
test eax, eax
jne 0x4721fd
and dword [ebp - 0xd28], 0
jmp 0x472207
mov dword [ebp - 0xd28], 1
cmp dword [ebp - 0xd28], 0
je 0x47222c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa64], 0
je 0x47222c
mov dword [ebp - 0x1b94], 1
jmp 0x472233
and dword [ebp - 0x1b94], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa64]
sub eax, dword [ebp - 0x1b94]
cmp eax, dword [ebp - 0x960]
jl 0x47225a
mov dword [ebp - 0xd30], 1
jmp 0x472261
and dword [ebp - 0xd30], 0
push 0
lea ecx, [ebp - 0x1f48]
call fcn.00434ffd
mov ecx, dword [ebp - 0xd30]
cmp ecx, dword [eax]
jne 0x472284
mov dword [ebp - 0x1b9c], 1
jmp 0x47228b
and dword [ebp - 0x1b9c], 0
push 0
lea ecx, [ebp - 0x1f48]
call fcn.00434ffd
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1b9c]
jle 0x4722ae
mov dword [ebp - 0xd38], 1
jmp 0x4722b5
and dword [ebp - 0xd38], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd38]
mov dword [ebp + eax - 0x33d0], ecx
lea ecx, [ebp - 0x1f48]
call fcn.00434fe1
mov dword [ebp - 0x42c], 0
jmp 0x4722ec
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jg 0x4726ec
mov dword [ebp - 0x444], 4
mov dword [ebp - 0x444], 0xfffffff0
jmp 0x47231c
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0xfffffff6
jge 0x4723dc
push 2
lea ecx, [ebp - 0x2658]
call fcn.00434f0f
mov dword [ebp - 0x538], 0xfffffff8
mov dword [ebp - 0x5f4], 0
jmp 0x472359
mov eax, dword [ebp - 0x5f4]
inc eax
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x5f4], 2
jge 0x47237b
push dword [ebp - 0x5f4]
lea ecx, [ebp - 0x2658]
call fcn.00434ffd
mov dword [eax], 0xffff
jmp 0x47234c
mov dword [ebp - 0x538], 0
jmp 0x472394
mov eax, dword [ebp - 0x538]
inc eax
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 2
jge 0x4723b6
push dword [ebp - 0x538]
lea ecx, [ebp - 0x2658]
call fcn.00434ffd
mov dword [eax], 0xe57b
jmp 0x472387
cmp dword [ebp - 0x444], 0
je 0x4723cc
lea ecx, [ebp - 0x2658]
call fcn.00434fe1
jmp 0x4723dc
lea ecx, [ebp - 0x2658]
call fcn.00434fe1
jmp 0x47230f
mov byte [ebp - 0x2cc], 0
movzx eax, byte [ebp - 0x2cc]
test eax, eax
je 0x4723f6
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
lea ecx, [ebp - 0x58c]
call fcn.00434f0f
mov dword [ebp - 0x2274], 0x631e19e9
mov dword [ebp - 0x54], 0
jmp 0x47241d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x472433
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x1ff4], 0xc85f70ad
jmp 0x472416
mov dword [ebp - 0x54], 0
jmp 0x472443
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x47245f
push dword [ebp - 0x54]
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov dword [eax], 0x20f89b5
jmp 0x47243c
mov dword [ebp - 0x54], 0
jmp 0x47246f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x472485
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x358c], 0xfffffffe
jmp 0x472468
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
and dword [eax], 0
jmp 0x4724bb
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov dword [ebp - 0x1ba4], eax
mov eax, dword [ebp - 0x1ba4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1ba4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
cmp dword [eax], 3
jg 0x4726c2
mov dword [ebp - 0x134], 0x214a9bac
mov dword [ebp - 0x2284], 1
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1ff4], 0
jne 0x472519
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
cmp dword [eax], 0
jne 0x472519
and dword [ebp - 0xd40], 0
jmp 0x472523
mov dword [ebp - 0xd40], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xd40]
mov dword [ebp + eax - 0x358c], ecx
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1ff4]
mov dword [ebp - 0x2bb4], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
cmp dword [eax], 0
je 0x47258e
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x1ff4]
push 0
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
cmp esi, dword [eax]
jne 0x47258e
mov dword [ebp - 0x1bac], 1
jmp 0x472595
and dword [ebp - 0x1bac], 0
mov eax, dword [ebp - 0x1bac]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2274], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1ff4]
mov dword [ebp - 0x2bbc], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1ff4]
mov dword [ebp - 0x2bc4], eax
imul eax, dword [ebp - 0x134], 0xffff
cmp eax, 0xcd204465
jae 0x472602
mov dword [ebp - 0xd48], 1
jmp 0x472609
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0xd48]
cmp eax, dword [ebp - 0x134]
je 0x472632
mov eax, 0x2e11
test eax, eax
je 0x472632
mov dword [ebp - 0x227c], 1
jmp 0x472639
and dword [ebp - 0x227c], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2bcc], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1ff4]
mov dword [ebp - 0x2bd4], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2bdc], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1ff4]
mov dword [ebp - 0x1bb4], eax
push 1
lea ecx, [ebp - 0x58c]
call fcn.00434ffd
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1bb4]
mov dword [ebp + eax*4 - 0x1ff4], ecx
mov eax, dword [ebp - 0x1bb4]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x2284], eax
jmp 0x472497
lea ecx, [ebp - 0x58c]
call fcn.00434fe1
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x42c]
mov eax, dword [ebp + eax*4 - 0x968]
mov dword [ebp + ecx*4 - 0x968], eax
jmp 0x4722df
mov dword [ebp - 0x30], 0x822e6e7f
mov dword [ebp - 0xb60], 0xa971867b
mov dword [ebp - 0xd58], 0x4d8d955a
push 2
lea ecx, [ebp - 0xb30]
call fcn.00434f0f
mov dword [ebp - 0x261c], 1
mov dword [ebp - 0x2618], 1
mov dword [ebp - 0x2614], 1
mov dword [ebp - 0x2610], 1
mov dword [ebp - 0x8b4], 0
jmp 0x472755
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 2
jge 0x472777
push dword [ebp - 0x8b4]
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
mov dword [eax], 0xc1c5
jmp 0x472748
cmp dword [ebp - 0x30], 0
je 0x47288d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2be4], eax
cmp dword [ebp - 0x30], 0
jne 0x47281c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2bec], eax
mov eax, 0xdb39523d
cmp eax, 0xa98ceef
je 0x4727b5
mov dword [ebp - 0x228c], 1
jmp 0x4727bc
and dword [ebp - 0x228c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2bf4], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x30], eax
jle 0x4727d9
mov dword [ebp - 0xd50], 1
jmp 0x4727e0
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0xd50]
add eax, 0xe1ef
cmp eax, dword [ebp - 0x30]
jge 0x4727fc
mov dword [ebp - 0x1bbc], 1
jmp 0x472803
and dword [ebp - 0x1bbc], 0
mov eax, dword [ebp - 0x1bbc]
mov dword [ebp - 0xd58], eax
cmp dword [ebp - 0xd58], 0
je 0x47281c
cmp dword [ebp - 0x30], 0
or eax, 0xffffffff
cmp eax, 0x2249687
jge 0x472832
mov dword [ebp - 0x1bc4], 1
jmp 0x472839
and dword [ebp - 0x1bc4], 0
cmp dword [ebp - 0x1bc4], 0x4defc72f
jg 0x472860
push 0
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
cmp dword [eax], 0
jne 0x472860
and dword [ebp - 0xd60], 0
jmp 0x47286a
mov dword [ebp - 0xd60], 1
push 1
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
mov ecx, dword [ebp - 0xd60]
cmp ecx, dword [eax]
jg 0x47288d
mov dword [ebp - 0x2294], 1
jmp 0x472894
and dword [ebp - 0x2294], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2bfc], eax
cmp dword [ebp - 0x30], 0xd679
jle 0x4728b2
mov dword [ebp - 0x229c], 1
jmp 0x4728b9
and dword [ebp - 0x229c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0x2c04], eax
push 0
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
mov esi, eax
push 0
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x4728fc
mov dword [ebp - 0x1bcc], 1
jmp 0x472903
and dword [ebp - 0x1bcc], 0
push 0
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1bcc]
cmp ecx, dword [eax]
jge 0x472926
mov dword [ebp - 0xd68], 1
jmp 0x47292d
and dword [ebp - 0xd68], 0
mov esi, dword [ebp - 0xd68]
sub esi, 0x26547579
push 1
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
cmp esi, dword [eax]
jne 0x472956
mov dword [ebp - 0x1bd4], 1
jmp 0x47295d
and dword [ebp - 0x1bd4], 0
push 1
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1bd4]
imul ecx, dword [eax]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x261c], ecx
mov dword [ebp - 0x30], 0x1b
jmp 0x47298f
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x34
jl 0x472adf
mov dword [ebp - 0x3a4], 1
mov dword [ebp - 0x22ac], 0xffffffff
push 0
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
cmp dword [eax], 3
jb 0x4729cb
mov dword [ebp - 0x1bdc], 1
jmp 0x4729d2
and dword [ebp - 0x1bdc], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x261c], 0
jne 0x4729e8
cmp dword [ebp - 0x3a4], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x261c], 0xfffffff9
jne 0x472a03
mov dword [ebp - 0xd70], 1
jmp 0x472a0a
and dword [ebp - 0xd70], 0
mov eax, dword [ebp - 0xb60]
add eax, dword [ebp - 0xd70]
cmp eax, dword [ebp - 0x3a4]
je 0x472a2a
mov dword [ebp - 0x22a4], 1
jmp 0x472a31
and dword [ebp - 0x22a4], 0
mov eax, dword [ebp - 0x1bdc]
sub eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x3a4], eax
jle 0x472a51
mov dword [ebp - 0xd78], 1
jmp 0x472a58
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0xd78]
neg eax
je 0x472a80
push 0
lea ecx, [ebp - 0xb30]
call fcn.00434ffd
cmp dword [eax], 0
je 0x472a80
mov dword [ebp - 0x1be4], 1
jmp 0x472a87
and dword [ebp - 0x1be4], 0
mov eax, dword [ebp - 0x1be4]
imul eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xd80], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd80]
mov dword [ebp + eax - 0x261c], ecx
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0xd80]
jg 0x472ac7
mov dword [ebp - 0x1bec], 1
jmp 0x472ace
and dword [ebp - 0x1bec], 0
mov eax, dword [ebp - 0x1bec]
mov dword [ebp - 0x22ac], eax
jmp 0x472988
lea ecx, [ebp - 0xb30]
call fcn.00434fe1
push 0
lea ecx, [ebp - 0x1f54]
call fcn.00434ffd
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x968], 0
je 0x472b05
jmp 0x472b0a
jmp 0x471cdd
lea ecx, [ebp - 0x1f54]
call fcn.00434fe1
mov dword [ebp - 0x2824], 1
mov dword [ebp - 0x2820], 1
mov dword [ebp - 0x281c], 1
mov dword [ebp - 0x2818], 1
lea ecx, [ebp - 0xa6d]
call fcn.0043500c
push eax
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2824]
push eax
lea ecx, [ebp - 0x345c]
call fcn.0043500f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8fc]
call fcn.00434fbb
mov dword [ebp - 0xbc], 7
mov dword [ebp - 0x3f4], 0x47706695
mov dword [ebp - 0x22bc], 0xa7dd9ae6
mov dword [ebp - 0x22cc], 1
mov dword [ebp - 0x5fc], 0
jmp 0x472bb3
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 3
jge 0x472bcf
mov eax, dword [ebp - 0x5fc]
mov dword [ebp + eax*4 - 0x35e0], 0xffffffff
jmp 0x472ba6
mov dword [ebp - 0xbc], 3
jmp 0x472be8
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x472ed3
mov dword [ebp - 0x480], 0x90660d64
mov dword [ebp - 0x22d4], 0x7f45
push 3
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
cmp dword [ebp - 0xbc], 0xfffffffb
jge 0x472c3c
mov dword [ebp - 0xd88], 1
jmp 0x472c43
and dword [ebp - 0xd88], 0
push 3
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
mov ecx, dword [ebp - 0xd88]
cmp ecx, dword [eax]
jne 0x472c6c
cmp dword [ebp - 0x480], 0
jne 0x472c6c
and dword [ebp - 0x1bf4], 0
jmp 0x472c76
mov dword [ebp - 0x1bf4], 1
push 2
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1bf4]
cmp ecx, dword [eax]
jle 0x472c99
mov dword [ebp - 0xd90], 1
jmp 0x472ca0
and dword [ebp - 0xd90], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
imul eax, dword [ebp - 0xd90]
cmp eax, dword [ebp - 0x480]
jge 0x472ccd
mov dword [ebp - 0x1bfc], 1
jmp 0x472cd4
and dword [ebp - 0x1bfc], 0
mov eax, dword [ebp - 0x1bfc]
mov dword [ebp - 0x480], eax
mov esi, dword [ebp - 0x480]
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
cmp dword [eax], esi
je 0x472d07
mov dword [ebp - 0xd98], 1
jmp 0x472d0e
and dword [ebp - 0xd98], 0
push 1
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
mov ecx, dword [ebp - 0xd98]
cmp ecx, dword [eax]
je 0x472d31
mov dword [ebp - 0x1c04], 1
jmp 0x472d38
and dword [ebp - 0x1c04], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c04]
cmp ecx, dword [eax]
jne 0x472d5f
mov dword [ebp - 0xda0], 1
jmp 0x472d66
and dword [ebp - 0xda0], 0
cmp dword [ebp - 0xda0], 0x4801465e
jne 0x472d7e
mov dword [ebp - 0x22b4], 1
jmp 0x472d85
and dword [ebp - 0x22b4], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
cmp dword [eax], 0
ja 0x472da7
mov dword [ebp - 0x1c0c], 1
jmp 0x472dae
and dword [ebp - 0x1c0c], 0
mov eax, dword [ebp - 0x1c0c]
inc eax
mov dword [ebp - 0x22bc], eax
mov dword [ebp - 0x3f4], 3
jmp 0x472dd4
mov eax, dword [ebp - 0x3f4]
dec eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
jl 0x472ece
mov dword [ebp - 0xa6c], 0x7232
mov eax, 0x7c650ba4
test eax, eax
je 0x472e12
mov eax, 0xd869e772
test eax, eax
je 0x472e12
cmp dword [ebp - 0x480], 0
je 0x472e12
mov dword [ebp - 0x22c4], 1
jmp 0x472e19
and dword [ebp - 0x22c4], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0x2c0c], eax
mov esi, dword [ebp - 0xa6c]
push 3
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
add esi, dword [eax]
imul eax, esi, 0xe868
cmp eax, dword [ebp - 0x22cc]
je 0x472e65
mov dword [ebp - 0xda8], 1
jmp 0x472e6c
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0xa6c]
sub eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xda8]
jl 0x472e8c
mov dword [ebp - 0x1c14], 1
jmp 0x472e93
and dword [ebp - 0x1c14], 0
push 1
lea ecx, [ebp - 0x8fc]
call fcn.00434ffd
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c14]
je 0x472eb6
mov dword [ebp - 0xdb0], 1
jmp 0x472ebd
and dword [ebp - 0xdb0], 0
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0x22d4], eax
jmp 0x472dc7
jmp 0x472bdb
lea ecx, [ebp - 0x8fc]
call fcn.00434fe1
xor ecx, ecx
call fcn.0043527a
push eax
call fcn.0048a535
pop ecx
push 2
lea ecx, [ebp - 0x55c]
call fcn.00434f0f
mov dword [ebp - 0x22e4], 0xde7504ed
mov dword [ebp - 0x194], 0
jmp 0x472f1c
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x472f3b
push dword [ebp - 0x194]
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
or dword [eax], 0xffffffff
jmp 0x472f0f
mov dword [ebp - 0x194], 0
jmp 0x472f54
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x472f70
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x34b4], 1
jmp 0x472f47
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
cmp dword [eax], 0xfffffffb
ja 0x472f8e
mov dword [ebp - 0x1c1c], 1
jmp 0x472f95
and dword [ebp - 0x1c1c], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov esi, eax
push 1
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c1c]
add ecx, dword [eax]
cmp dword [esi], ecx
jne 0x472fc9
mov dword [ebp - 0xdb8], 1
jmp 0x472fd0
and dword [ebp - 0xdb8], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov esi, dword [ebp - 0xdb8]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
cmp esi, dword [eax]
jne 0x473002
mov dword [ebp - 0x1c24], 1
jmp 0x473009
and dword [ebp - 0x1c24], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c24]
cmp ecx, dword [eax]
jle 0x47302c
mov dword [ebp - 0x22dc], 1
jmp 0x473033
and dword [ebp - 0x22dc], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
push 4
pop eax
test eax, eax
je 0x473053
mov dword [ebp - 0x970], 1
jmp 0x47305a
and dword [ebp - 0x970], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x970]
mov dword [ebp + eax - 0x34b4], ecx
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov esi, dword [ebp - 0x970]
add esi, dword [eax]
neg esi
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
cmp dword [eax], esi
jle 0x4730b0
mov dword [ebp - 0xdc0], 1
jmp 0x4730b7
and dword [ebp - 0xdc0], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0xdc0]
cmp ecx, dword [eax]
jg 0x4730da
mov dword [ebp - 0x1c2c], 1
jmp 0x4730e1
and dword [ebp - 0x1c2c], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c2c]
cmp ecx, dword [eax]
jne 0x473104
mov dword [ebp - 0xdc8], 1
jmp 0x47310b
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0xdc8], 0x30045702
jne 0x473123
mov dword [ebp - 0x1c34], 1
jmp 0x47312a
and dword [ebp - 0x1c34], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c34]
cmp ecx, dword [eax]
jne 0x47314d
mov dword [ebp - 0xdd0], 1
jmp 0x473154
and dword [ebp - 0xdd0], 0
cmp dword [ebp - 0xdd0], 0x3eb905d0
jl 0x47316c
mov dword [ebp - 0x1c3c], 1
jmp 0x473173
and dword [ebp - 0x1c3c], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c3c]
cmp ecx, dword [eax]
jg 0x473196
mov dword [ebp - 0xdd8], 1
jmp 0x47319d
and dword [ebp - 0xdd8], 0
push 0
lea ecx, [ebp - 0x55c]
call fcn.00434ffd
mov ecx, dword [ebp - 0xdd8]
cmp ecx, dword [eax]
je 0x4731c0
mov dword [ebp - 0x1c44], 1
jmp 0x4731c7
and dword [ebp - 0x1c44], 0
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 0x22e4], eax
mov byte [ebp - 0x2ce], 0
movzx eax, byte [ebp - 0x2ce]
test eax, eax
je 0x4731fa
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
lea ecx, [ebp - 0x55c]
call fcn.00434fe1
push 4
lea ecx, [ebp - 0x1e64]
call fcn.00434f0f
mov dword [ebp - 0x104], 3
mov dword [ebp - 0x40], 0
jmp 0x47322c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x473248
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1e64]
call fcn.00434ffd
mov dword [eax], 1
jmp 0x473225
mov dword [ebp - 0x40], 0
jmp 0x473258
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x47326e
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1f10], 0xfffffff7
jmp 0x473251
mov dword [ebp - 0x40], 0
jmp 0x47327e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x473294
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x3554], 0x9d70
jmp 0x473277
mov byte [ebp - 0x2d0], 0
movzx eax, byte [ebp - 0x2d0]
test eax, eax
je 0x4732b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 2
lea ecx, [ebp - 0x1e64]
call fcn.00434ffd
push 3
lea ecx, [ebp - 0x1e64]
call fcn.00434ffd
cmp dword [eax], 0
jne 0x4732fa
push 1
lea ecx, [ebp - 0x1e64]
call fcn.00434ffd
mov esi, eax
push 2
lea ecx, [ebp - 0x1e64]
call fcn.00434ffd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x4732fa
and dword [ebp - 0xde0], 0
jmp 0x473304
mov dword [ebp - 0xde0], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1f10]
cmp dword [ebp - 0xde0], eax
jle 0x473325
mov dword [ebp - 0x1c4c], 1
jmp 0x47332c
and dword [ebp - 0x1c4c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c4c]
sub ecx, dword [ebp + eax - 0x1f10]
cmp ecx, 0xfecf
jl 0x473352
mov dword [ebp - 0xde8], 1
jmp 0x473359
and dword [ebp - 0xde8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f10]
cmp dword [ebp - 0xde8], eax
jge 0x47337a
mov dword [ebp - 0x1c54], 1
jmp 0x473381
and dword [ebp - 0x1c54], 0
mov eax, dword [ebp - 0x1c54]
add eax, 0xfd9d
jne 0x4733a7
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1f10], 0
jne 0x4733a7
and dword [ebp - 0xdf0], 0
jmp 0x4733b1
mov dword [ebp - 0xdf0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f10]
cmp dword [ebp - 0xdf0], eax
jge 0x4733d2
mov dword [ebp - 0x1c5c], 1
jmp 0x4733d9
and dword [ebp - 0x1c5c], 0
imul eax, dword [ebp - 0x1c5c], 0xffff
test eax, eax
je 0x4736be
push 2
lea ecx, [ebp - 0x908]
call fcn.00434f0f
push 2
lea ecx, [ebp - 0x2a38]
call fcn.00434f0f
mov dword [ebp - 0x22f4], 0x4763523e
mov dword [ebp - 0x13c], 0
jmp 0x473428
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x47344a
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x908]
call fcn.00434ffd
mov dword [eax], 1
jmp 0x47341b
mov dword [ebp - 0x13c], 0
jmp 0x473463
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x473485
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x2a38]
call fcn.00434ffd
mov dword [eax], 1
jmp 0x473456
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
mov eax, dword [eax]
mov dword [ebp - 0x104], eax
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
cmp dword [eax], 0
je 0x473693
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x1f10]
push 1
lea ecx, [ebp - 0x908]
call fcn.00434ffd
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x908]
call fcn.00434ffd
cmp esi, dword [eax]
jge 0x4734ea
mov dword [ebp - 0xdf8], 1
jmp 0x4734f1
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0xdf8], eax
jge 0x47350b
mov dword [ebp - 0x1c64], 1
jmp 0x473512
and dword [ebp - 0x1c64], 0
push 0
lea ecx, [ebp - 0x2a38]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c64]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
cmp dword [eax], 0x9c010580
ja 0x473551
mov eax, 0xcd8491f1
test eax, eax
je 0x473551
mov dword [ebp - 0xe00], 1
jmp 0x473558
and dword [ebp - 0xe00], 0
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe00]
jg 0x47357b
mov dword [ebp - 0x1c6c], 1
jmp 0x473582
and dword [ebp - 0x1c6c], 0
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
mov ecx, dword [ebp - 0x1c6c]
cmp ecx, dword [eax]
jl 0x4735a5
mov dword [ebp - 0xe08], 1
jmp 0x4735ac
and dword [ebp - 0xe08], 0
imul esi, dword [ebp - 0xe08], 0xdefc
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
cmp esi, dword [eax]
je 0x4735d3
mov dword [ebp - 0x1c74], 1
jmp 0x4735da
and dword [ebp - 0x1c74], 0
mov eax, dword [ebp - 0x1c74]
mov dword [ebp - 0x104], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1f10]
cmp dword [ebp - 0x104], eax
jge 0x473607
mov dword [ebp - 0xe10], 1
jmp 0x47360e
and dword [ebp - 0xe10], 0
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
mov eax, dword [eax]
cmp eax, dword [ebp - 0xe10]
jg 0x473631
mov dword [ebp - 0x1c7c], 1
jmp 0x473638
and dword [ebp - 0x1c7c], 0
push 2
lea ecx, [ebp - 0x1e64]
call fcn.00434ffd
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1c7c]
jne 0x47365b
mov dword [ebp - 0x22ec], 1
jmp 0x473662
and dword [ebp - 0x22ec], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1f10]
mov dword [ebp - 0x2c14], eax
push 0
lea ecx, [ebp - 0x908]
call fcn.00434ffd
cmp dword [eax], 0
je 0x473693
mov dword [ebp - 0xe18], 1
jmp 0x47369a
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0x22f4], eax
lea ecx, [ebp - 0x2a38]
call fcn.00434fe1
lea ecx, [ebp - 0x908]
call fcn.00434fe1
jmp 0x4736f3
mov dword [ebp - 0x104], 0
jmp 0x4736d7
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 4
jge 0x4736f3
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x1f10], 0x1067dcc3
jmp 0x4736ca
lea ecx, [ebp - 0x1e64]
call fcn.00434fe1
mov dword [ebp - 0x208], 0x36ccb036
mov dword [ebp - 0x2c1c], 0xd21dfe4
mov dword [ebp - 0x1c84], 0xffff
mov dword [ebp - 0x2314], 0xfffd
mov dword [ebp - 0x108], 0
jmp 0x47373f
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x47375b
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x3ac], 0
jmp 0x473732
mov dword [ebp - 0x108], 0
jmp 0x473774
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x473790
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x33c4], 0xffffffff
jmp 0x473767
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3ac], 0
jmp 0x4737be
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ac], 0xffffffec
jle 0x473857
mov dword [ebp - 0x22fc], 0
mov dword [ebp - 0x2304], 7
push 2
lea ecx, [ebp - 0x2f78]
call fcn.00434f0f
mov dword [ebp - 0x76c], 0
jmp 0x47380c
mov eax, dword [ebp - 0x76c]
inc eax
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0x76c], 2
jge 0x47382e
push dword [ebp - 0x76c]
lea ecx, [ebp - 0x2f78]
call fcn.00434ffd
mov dword [eax], 0xdb85613
jmp 0x4737ff
mov eax, dword [ebp - 0x22fc]
mov dword [ebp - 0x2304], eax
mov eax, dword [ebp - 0x1c84]
dec eax
mov dword [ebp - 0x1c84], eax
lea ecx, [ebp - 0x2f78]
call fcn.00434fe1
jmp 0x4737a3
mov dword [ebp - 0x208], 0
jmp 0x473870
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x1b
jge 0x473b0c
mov dword [ebp - 0x4f0], 0x10e6b6cd
mov dword [ebp - 0x1c94], 1
mov dword [ebp - 0xae8], 1
mov byte [ebp - 0x2d2], 0
movzx eax, byte [ebp - 0x2d2]
test eax, eax
je 0x4738b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x2c24], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33c4]
mov dword [ebp - 0xe20], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xe20]
mov dword [ebp + eax - 0x33c4], ecx
cmp dword [ebp - 0xe20], 0
je 0x4739aa
mov eax, 0x4ed383de
test eax, eax
je 0x473906
cmp dword [ebp - 0x4f0], 0
mov eax, 0x8f1e
test eax, eax
je 0x473924
cmp dword [ebp - 0x208], 0
je 0x473924
mov dword [ebp - 0x1c8c], 1
jmp 0x47392b
and dword [ebp - 0x1c8c], 0
cmp dword [ebp - 0x1c8c], 1
jle 0x473940
mov dword [ebp - 0x230c], 1
jmp 0x473947
and dword [ebp - 0x230c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
mov dword [ebp - 0x2c2c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ac]
mov dword [ebp - 0x2c34], eax
cmp dword [ebp - 0x208], 0
je 0x473982
mov dword [ebp - 0xe28], 1
jmp 0x473989
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
mov dword [ebp - 0x1c94], eax
cmp dword [ebp - 0x1c94], 0
je 0x4739aa
mov dword [ebp - 0xe30], 1
jmp 0x4739b1
and dword [ebp - 0xe30], 0
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0x4f0]
cmp eax, 1
jbe 0x4739fa
mov byte [ebp - 0x2d4], 0
movzx eax, byte [ebp - 0x2d4]
test eax, eax
je 0x4739f5
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x473b07
mov dword [ebp - 0x1cac], 0xfffffffe
mov dword [ebp - 0x1ca4], 0xfffffff8
mov dword [ebp - 0x488], 0xa1bab0c3
cmp dword [ebp - 0x488], 0
jne 0x473a38
mov eax, dword [ebp - 0x4f0]
cmp dword [ebp - 0x488], eax
jge 0x473a38
and dword [ebp - 0x1c9c], 0
jmp 0x473a42
mov dword [ebp - 0x1c9c], 1
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x1c9c]
add ecx, 0x71c2
add eax, ecx
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x488], eax
jne 0x473a76
mov dword [ebp - 0xe38], 1
jmp 0x473a7d
and dword [ebp - 0xe38], 0
mov dword [ebp - 0x1ca4], 0
mov eax, dword [ebp - 0xe38]
add eax, 0x469bf966
cmp dword [ebp - 0x1ca4], eax
jl 0x473aa6
mov dword [ebp - 0xe40], 1
jmp 0x473aad
and dword [ebp - 0xe40], 0
mov eax, dword [ebp - 0xae8]
cmp dword [ebp - 0xe40], eax
je 0x473ac7
mov dword [ebp - 0xe48], 1
jmp 0x473ace
and dword [ebp - 0xe48], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1cac], eax
mov eax, dword [ebp - 0x1cac]
cmp eax, dword [ebp - 0xe48]
jge 0x473af4
mov dword [ebp - 0x1cb4], 1
jmp 0x473afb
and dword [ebp - 0x1cb4], 0
mov eax, dword [ebp - 0x1cb4]
mov dword [ebp - 0x2314], eax
jmp 0x473863
mov dword [ebp - 0x2964], 1
mov dword [ebp - 0x2960], 1
mov dword [ebp - 0x295c], 1
mov dword [ebp - 0x2958], 1
lea ecx, [ebp - 0xab1]
call fcn.0043500c
push eax
lea eax, [ebp - 0x2954]
push eax
lea eax, [ebp - 0x2964]
push eax
lea ecx, [ebp - 0x3574]
call fcn.0043500f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x914]
call fcn.00434fbb
mov dword [ebp - 0x824], 0xffffffff
mov dword [ebp - 0x604], 0
jmp 0x473b8c
mov eax, dword [ebp - 0x604]
inc eax
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 3
jge 0x473ba8
mov eax, dword [ebp - 0x604]
mov dword [ebp + eax*4 - 0x3610], 0
jmp 0x473b7f
mov dword [ebp - 0x824], 0
jmp 0x473bc1
mov eax, dword [ebp - 0x824]
inc eax
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 2
jg 0x473be8
mov byte [ebp - 0x2d6], 0
movzx eax, byte [ebp - 0x2d6]
test eax, eax
je 0x473be6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x473bb4
mov dword [ebp - 0xac], 7
mov dword [ebp - 0xe60], 0xba772304
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x2c3c], 1
mov dword [ebp - 0x2c44], 3
mov dword [ebp - 0x2c4c], 0xc62bb2c5
mov dword [ebp - 0x2c54], 0xfffffffc
mov dword [ebp - 0x2c5c], 0xb7758b39
mov dword [ebp - 0x2c64], 0xfffffff7
mov dword [ebp - 0x2c6c], 0xa4d91f06
mov dword [ebp - 0x2c74], 0xe7f13bcf
mov dword [ebp - 0x2c7c], 0xfffffff6
mov dword [ebp - 0x3228], 1
mov dword [ebp - 0x3224], 1
mov dword [ebp - 0x3220], 1
mov dword [ebp - 0x321c], 1
mov dword [ebp - 0x284c], 0x1b546539
mov dword [ebp - 0x2848], 0x1b546539
mov dword [ebp - 0x2844], 0x1b546539
mov dword [ebp - 0x2840], 0x1b546539
lea ecx, [ebp - 0x91d]
call fcn.0043500c
push eax
lea eax, [ebp - 0x283c]
push eax
lea eax, [ebp - 0x284c]
push eax
lea ecx, [ebp - 0x346c]
call fcn.0043500f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x33f4]
call fcn.00434fbb
cmp dword [ebp - 0x98], 0
je 0x473d03
cmp dword [ebp - 0x98], 0
je 0x473d03
mov dword [ebp - 0xe50], 1
jmp 0x473d0a
and dword [ebp - 0xe50], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x98], eax
jg 0x473d24
mov dword [ebp - 0x1cbc], 1
jmp 0x473d2b
and dword [ebp - 0x1cbc], 0
mov eax, dword [ebp - 0x98]
add eax, dword [ebp - 0xe50]
cmp eax, dword [ebp - 0x1cbc]
je 0x473d4b
mov dword [ebp - 0xe58], 1
jmp 0x473d52
and dword [ebp - 0xe58], 0
mov eax, dword [ebp - 0xe58]
sub eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x98]
jle 0x473d72
mov dword [ebp - 0x1cc4], 1
jmp 0x473d79
and dword [ebp - 0x1cc4], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xe60], 0xfffffff6
mov eax, dword [ebp - 0x98]
neg eax
cmp dword [ebp - 0xe60], eax
jge 0x473da5
mov dword [ebp - 0x1ccc], 1
jmp 0x473dac
and dword [ebp - 0x1ccc], 0
cmp dword [ebp - 0x1ccc], 9
jg 0x473dc1
mov dword [ebp - 0xe68], 1
jmp 0x473dc8
and dword [ebp - 0xe68], 0
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x473e16
imul eax, dword [ebp - 0x98], 0xffff
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x296], 0
movzx eax, byte [ebp - 0x296]
test eax, eax
je 0x473e11
push 0xa0a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x473f35
mov dword [ebp - 0x2c84], 1
mov dword [ebp - 0x2c8c], 0x4448110c
mov dword [ebp - 0x2c94], 0x2e072305
mov dword [ebp - 0x2c9c], 0x8670fc24
mov dword [ebp - 0x2ca4], 0xe784b52d
mov dword [ebp - 0x2cac], 0xffffffff
mov dword [ebp - 0x2cb4], 0x5752783d
mov dword [ebp - 0x2cbc], 0
mov dword [ebp - 0x2cc4], 0xfffffffa
mov dword [ebp - 0x2ccc], 0x3e8ea471
mov dword [ebp - 0x2cd4], 0
push 1
lea ecx, [ebp - 0x2f88]
call fcn.00434f0f
mov dword [ebp - 0x2cdc], 0x76e9f81a
mov dword [ebp - 0x1cd4], 9
mov dword [ebp - 0x5c], 0
jmp 0x473eb5
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x473ecb
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x35ec], 0x2b4b5a9c
jmp 0x473eae
mov dword [ebp - 0x5c], 0
jmp 0x473edb
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x473ef7
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x2f88]
call fcn.00434ffd
mov dword [eax], 0xfffffff9
jmp 0x473ed4
mov dword [ebp - 0x5c], 0
jmp 0x473f07
cmp dword [ebp - 0x5c], 2
jge 0x473f1d
lea ecx, [ebp - 0x33f4]
call fcn.00434fe1
mov dword [ebp - 0x3fc], 0x47706695
mov dword [ebp - 0x25d0], 0xa7dd9ae6
mov dword [ebp - 0xe70], 0xa6b950ba
mov dword [ebp - 0x2ce4], 0xbe6286c
mov dword [ebp - 0x2cec], 0xbe74fd57
mov dword [ebp - 0x774], 0xffffffff
mov dword [ebp - 0x2cf4], 0x50ba
mov dword [ebp - 0x2cfc], 0
mov dword [ebp - 0x231c], 0x5a323196
mov dword [ebp - 0x2d04], 0x392614f5
mov dword [ebp - 0x60c], 0
jmp 0x473fbd
mov eax, dword [ebp - 0x60c]
inc eax
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 2
jge 0x473fd9
mov eax, dword [ebp - 0x60c]
mov dword [ebp + eax*4 - 0x2e54], 0x5a7dd9ae
jmp 0x473fb0
cmp dword [ebp - 0xe70], 0
je 0x474045
cmp dword [ebp - 0xe70], 0
je 0x474000
and dword [ebp - 0x1ce4], 0
mov eax, dword [ebp - 0x774]
cmp dword [ebp - 0x1ce4], eax
je 0x474066