Function at 0x4b9890
Capabilities:
Check for unmoving mouse cursor
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x57dce3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4f4
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0055a0c1
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0xd8]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xdc]
mov edi, 2
add eax, edi
mov dword [esp + 0xdc], eax
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [esp + 0x514]
mov eax, ecx
and eax, 1
cmp eax, 1
mov dword [esp + 0x34], eax
je 0x4b9916
and ecx, edi
cmp cl, 2
jne 0x4bb34e
mov ecx, dword [esp + 0x518]
mov eax, dword [esi + 0x1bc]
mov edx, dword [esp + 0x51c]
mov dword [esi + 0x1f4], ecx
cmp eax, 9
mov dword [esi + 0x1f8], edx
je 0x4b9956
mov eax, dword [esi + 0x1fc]
test eax, eax
je 0x4b994c
mov ecx, esi
call fcn.004c1380
mov dword [esi + 0x1fc], 0
cmp dword [esi + 0x1bc], 0xd
je 0x4b997d
cmp dword [esi + 0x228], edi
jl 0x4b996e
mov ecx, esi
call fcn.004c1380
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x220]
call fcn.004c31b0
mov edx, dword [esi + 0x1bc]
mov eax, dword [esi + 0x1c0]
xor ecx, ecx
cmp edx, eax
je 0x4b9994
mov ecx, 1
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov ebp, eax
test ecx, ecx
mov dword [esp + 0x4c], ebp
jne 0x4b9b24
cmp edx, 7
jne 0x4b9a3c
cmp dword [esi + 0x1b4], 1
jne 0x4b9a3c
lea eax, [esp + 0x20]
push eax
call ebx
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call edi
lea eax, [esi + 0x184]
mov ecx, dword [esi + 0x184]
mov dword [esp + 0x5c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x60], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x24]
push eax
push ecx
lea ecx, [esi + 0x84]
mov dword [esp + 0x70], edx
call fcn.005671f2
cmp eax, 0xffffffff
je 0x4b9a1a
cmp eax, 8
jne 0x4ba295
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
lea ecx, [esp + 0x60]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ba295
jmp 0x4b9b1a
cmp edx, 1
jne 0x4b9aae
cmp dword [esi + 0x1b4], edx
jne 0x4b9aae
lea edx, [esp + 0x54]
push edx
call ebx
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x54]
push eax
push ecx
call edi
lea edx, [esi + 0x194]
mov eax, dword [esi + 0x194]
mov dword [esp + 0x90], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x94], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x54]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x9c], ecx
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ba295
jmp 0x4b9b1a
cmp edx, 0x10
jne 0x4ba295
lea edx, [esp + 0x54]
push edx
call ebx
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x54]
push eax
push ecx
call edi
lea edx, [esi + 0x194]
mov eax, dword [esi + 0x194]
mov dword [esp + 0x90], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x94], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x54]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x9c], ecx
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ba295
mov ebp, dword [esi + 0x1bc]
mov dword [esp + 0x4c], ebp
cmp dword [esi + 0x1b4], 1
jne 0x4ba295
cmp ebp, 7
je 0x4b9b44
cmp ebp, 1
je 0x4b9b44
cmp ebp, 0x10
jne 0x4ba295
mov eax, ebp
dec eax
je 0x4ba088
sub eax, 6
je 0x4b9cc0
sub eax, 9
jne 0x4ba25c
lea edx, [esp + 0x10]
push edx
call ebx
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x194]
mov edx, edi
mov eax, dword [edx]
mov dword [esp + 0x20], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ba25c
push esi
lea ecx, [esp + 0x3c]
call fcn.00560763
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x80]
push edx
push eax
mov dword [esp + 0x514], 2
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [esp + 0x88]
mov ebx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
sub ebp, ebx
mov ebx, dword [esp + 0x8c]
lea eax, [esi + 0xfc]
sub ebx, edx
test eax, eax
je 0x4b9c0c
mov eax, dword [esi + 0x100]
mov ecx, dword [esp + 0x3c]
push 0xcc0020
push 0
push 0
push eax
push ebx
push ebp
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004c1380
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
mov dword [esp + 0x18], edi
lea edi, [esi + 0x16c]
sub ecx, edx
mov edx, dword [esi + 0x198]
test edi, edi
je 0x4b9c56
mov edi, dword [edi + 4]
push 0xcc0020
push 0
push 0
push edi
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push eax
mov eax, dword [esi + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x34]
push edx
push eax
call edi
lea eax, [esi + 0xfc]
test eax, eax
je 0x4b9c84
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x3c]
push 0xcc0020
push 0
push 0
push eax
push ebx
push ebp
push 0
push 0
push ecx
call edi
mov edx, dword [esi + 0x1c4]
or eax, 0xffffffff
mov dword [esi + 0x1b4], eax
mov dword [esi + 0x1bc], edx
mov dword [esp + 0x50c], eax
lea ecx, [esp + 0x38]
jmp 0x4ba24d
push esi
lea ecx, [esp + 0xa4]
call fcn.00560763
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x6c]
push eax
push ecx
mov dword [esp + 0x514], 3
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x70]
sub ebx, edi
lea edi, [esi + 0xfc]
sub ecx, edx
mov dword [esp + 0x80], ebx
test edi, edi
mov dword [esp + 0x20], ecx
jne 0x4b9d14
xor eax, eax
jmp 0x4b9d17
mov eax, dword [edi + 4]
mov edx, dword [esp + 0xa4]
push 0xcc0020
push 0
push 0
push eax
push ecx
push ebx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x5ed678
lea ecx, [esp + 0x1c]
call fcn.0055969a
mov eax, dword [esi + 0x58]
mov byte [esp + 0x50c], 4
test eax, eax
je 0x4b9d5f
lea eax, [esp + 0x18]
lea ecx, [esi + 0x3c]
push eax
call fcn.0055aad3
mov ecx, dword [esp + 0x18]
push 0x5ed678
push ecx
call fcn.00541319
add esp, 8
test eax, eax
je 0x4b9d7c
mov ecx, esi
call fcn.004c1380
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esi + 0x184]
mov edx, dword [esi + 0x184]
mov dword [esp + 0x38], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + 8]
push ecx
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
push edx
lea ecx, [esi + 0x84]
mov dword [esp + 0x4c], eax
call fcn.005671f2
cmp eax, 0xffffffff
je 0x4b9de5
cmp eax, 8
je 0x4b9de5
mov dword [esi + 0x1b8], eax
jmp 0x4ba05b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ba05b
mov ecx, dword [esi + 0xf4]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x30]
cmp dword [esi + 0x1e8], 1
jne 0x4b9e24
push 1
mov ecx, edi
call fcn.005600f3
jmp 0x4b9e3b
push 2
mov ecx, edi
call fcn.005600f3
mov eax, dword [esi + 0xf8]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x2c]
cmp dword [esi + 0x1e8], 2
jne 0x4b9e70
mov edx, dword [edi]
push 8
mov ecx, edi
call dword [edx + 0x24]
mov ebp, eax
mov eax, dword [esi + 0xf8]
push eax
lea eax, [esi + 0x184]
push eax
mov ecx, edi
call fcn.00566b08
test ebp, ebp
je 0x4b9e70
push ebp
mov ecx, edi
call fcn.00560017
mov eax, dword [esi + 0x58]
test eax, eax
je 0x4b9ff7
push 0x5ed678
lea ecx, [esp + 0x20]
call fcn.0055969a
push 0x5ed678
lea ecx, [esp + 0x34]
mov byte [esp + 0x510], 5
call fcn.0055969a
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 6
push ecx
lea ecx, [esi + 0x3c]
call fcn.0055aad3
mov edx, dword [esp + 0x30]
push 0x5ed678
push edx
call fcn.00541319
add esp, 8
test eax, eax
je 0x4b9fd5
mov eax, dword [edi]
lea ecx, [esi + 0x234]
push ecx
mov ecx, edi
call dword [eax + 0x28]
mov edx, dword [esi + 0x58]
push 0
push 0
push 0xba
push edx
mov dword [esp + 0x60], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jle 0x4b9fa9
mov eax, dword [esi + 0x58]
push 0
push ebp
push 0xbb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x58]
push 0
push eax
push 0xc1
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4b9f8b
mov eax, dword [esi + 0x58]
lea edx, [esp + 0x104]
push edx
push ebp
push 0xc4
push eax
mov word [esp + 0x114], 0x3ff
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x104]
mov byte [esp + eax + 0x104], 0
push ecx
lea ecx, [esp + 0xc0]
call fcn.0055969a
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x510], 7
call fcn.00559a44
lea ecx, [esp + 0xbc]
mov byte [esp + 0x50c], 6
call fcn.0055962c
lea eax, [ebx - 1]
cmp ebp, eax
je 0x4b9fa0
push 0x5d7f50
lea ecx, [esp + 0x20]
call fcn.00559a08
inc ebp
cmp ebp, ebx
jl 0x4b9eff
mov eax, dword [esp + 0x1c]
mov ebx, dword [edi]
lea edx, [esi + 0x184]
push 0x10
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov ecx, edi
call dword [ebx + 0x68]
mov eax, dword [esp + 0x50]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x28]
mov ebx, dword [esp + 0x80]
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 5
call fcn.0055962c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50c], 4
call fcn.0055962c
lea ebp, [esi + 0x3c]
push 0
mov ecx, ebp
call fcn.0055cf5c
push 0x5ed678
mov ecx, ebp
call fcn.0055ce5b
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [esi + 0x8c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetRect]
test edi, edi
je 0x4ba02b
mov edi, dword [edi + 4]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0xa4]
push 0xcc0020
push 0
push 0
push edi
push edx
push ebx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ebp, dword [esp + 0x4c]
mov dword [esi + 0x1b4], 0xffffffff
lea ecx, [esp + 0x18]
mov byte [esp + 0x50c], 3
call fcn.0055962c
lea ecx, [esp + 0xa0]
mov dword [esp + 0x50c], 0xffffffff
call fcn.005607d5
jmp 0x4ba256
lea ecx, [esp + 0x10]
push ecx
call ebx
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x194]
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0x38], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x3c], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], eax
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ba25c
push esi
lea ecx, [esp + 0xa4]
call fcn.00560763
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x6c]
push ecx
push edx
mov dword [esp + 0x514], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x78]
mov ebx, dword [esp + 0x70]
sub eax, ebp
lea ebp, [esi + 0xfc]
sub ecx, ebx
mov dword [esp + 0x80], eax
test ebp, ebp
mov dword [esp + 0x20], ecx
jne 0x4ba132
xor edx, edx
jmp 0x4ba135
mov edx, dword [ebp + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
push eax
mov eax, dword [esp + 0xbc]
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004c1380
mov edx, dword [ebp]
push 8
mov ecx, ebp
call dword [edx + 0x24]
push 0xffffff
lea ecx, [esp + 0x60]
mov dword [esp + 0x54], eax
call fcn.00560ac8
test eax, eax
je 0x4ba17d
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x100]
push eax
lea eax, [esi + 0x184]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov dword [esp + 0x5c], vtable.CGdiObject.0
lea ecx, [esp + 0x5c]
mov byte [esp + 0x50c], 1
call fcn.00560a62
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
lea edx, [esi + 0x16c]
sub ecx, ebx
mov ebx, dword [esi + 0x198]
mov byte [esp + 0x50c], 0
test edx, edx
je 0x4ba1d7
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 0x100]
push eax
push ecx
push ebx
push edi
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
test ebp, ebp
jne 0x4ba1fa
xor eax, eax
jmp 0x4ba1fd
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x80]
push 0xcc0020
mov edx, dword [esp + 0xa8]
push 0
push 0
push eax
mov eax, dword [esp + 0x30]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x50]
or edi, 0xffffffff
test eax, eax
mov dword [esi + 0x1b4], edi
je 0x4ba23f
push eax
mov ecx, ebp
call fcn.00560017
mov dword [esp + 0x50c], edi
lea ecx, [esp + 0xa0]
call fcn.005607d5
mov ebp, dword [esp + 0x4c]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [esi + 0x1bc]
xor ecx, ecx
xor eax, eax
push ecx
push eax
push 1
mov ecx, esi
mov dword [esi + 0x1bc], ebp
call fcn.004bef10
cmp edi, 7
mov dword [esi + 0x1bc], edi
jne 0x4ba295
cmp ebp, edi
jne 0x4ba295
mov dword [esi + 0x1b4], 0xffffffff
jmp 0x4bb34e
mov eax, dword [esi + 0x1bc]
dec eax
cmp eax, 0xf
ja case.0x4ba2ad.9
xor ecx, ecx
mov cl, byte [eax + 0x4bb390]
jmp dword [ecx*4 + 0x4bb36c]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
push esi
lea ecx, [esp + 0xa4]
call fcn.00560763
mov edx, dword [esp + 0x51c]
mov eax, dword [esp + 0x518]
mov ecx, dword [esp + 0xa4]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov dword [esi + 0xf4], eax
cmp dword [esp + 0x34], 1
jne 0x4ba306
lea edx, [esp + 0x18]
push 0
push edx
push 0x178a
jmp 0x4ba321
mov ecx, dword [esp + 0x514]
and ecx, 2
cmp cl, 2
jne 0x4ba32e
lea edx, [esp + 0x18]
push 0
push edx
push 0x178b
mov eax, dword [esi + 0x244]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0xa0]
jmp 0x4bb32f
push esi
lea ecx, [esp + 0x70]
call fcn.00560763
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x38]
push ecx
push edx
mov dword [esp + 0x514], 8
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.CRgn.0
lea eax, [esp + 0x38]
mov byte [esp + 0x50c], 9
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x24]
call fcn.00560a0b
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
call fcn.0056005d
cmp dword [esp + 0x34], 1
jne 0x4ba3a8
mov eax, dword [esi + 0xf4]
jmp 0x4ba3ae
mov eax, dword [esi + 0xf8]
push eax
lea ecx, [esp + 0x14]
call fcn.00560ac8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x6c]
push edx
mov byte [esp + 0x510], 0xa
call fcn.00560017
mov ebx, dword [esp + 0x51c]
mov edi, dword [esp + 0x518]
mov eax, dword [esp + 0x70]
push ebx
push edi
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, dword [esp + 0x70]
push 1
push eax
push ebx
push edi
push ecx
call dword [sym.imp.GDI32.dll_ExtFloodFill]
lea ecx, [esp + 0x10]
call fcn.00560a62
lea ecx, [esp + 0x20]
call fcn.00560a62
mov ecx, esi
call fcn.004c1380
mov edi, vtable.CGdiObject.0
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0xb
call fcn.00560a62
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x50c], 0xc
call fcn.00560a62
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x6c]
jmp 0x4bb32f
mov ecx, dword [esp + 0x34]
mov eax, 1
xor edi, edi
cmp ecx, eax
mov dword [esp + 0x30], edi
jne 0x4ba46c
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x514]
mov dword [esp + 0x18], edi
and edx, 8
cmp dl, 8
jne 0x4ba483
mov dword [esp + 0x18], eax
push esi
lea ecx, [esp + 0x70]
call fcn.00560763
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x38]
push eax
push ecx
mov dword [esp + 0x514], 0xd
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], vtable.CRgn.0
lea edx, [esp + 0x38]
mov byte [esp + 0x50c], 0xe
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x84]
call fcn.00560a0b
lea eax, [esp + 0x80]
lea ecx, [esp + 0x6c]
push eax
call fcn.0056005d
mov eax, dword [esi + 0x1d8]
mov dword [esp + 0x1c], edi
lea ecx, [eax + eax*4]
shl ecx, 2
js 0x4ba5fc
mov edi, dword [esi + 0x1d8]
call fcn.005417dc
cdq
lea ecx, [edi + edi]
idiv ecx
mov ebp, edx
sub ebp, edi
mov edi, dword [esi + 0x1d8]
call fcn.005417dc
cdq
lea ecx, [edi + edi]
idiv ecx
mov ecx, ebp
imul ecx, ebp
sub edx, edi
mov eax, edx
mov dword [esp + 0x20], edx
imul eax, edx
add eax, ecx
mov ecx, edi
imul ecx, edi
cmp eax, ecx
jg 0x4ba5df
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4ba567
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4ba55e
mov eax, dword [esi + 0xf4]
push eax
jmp 0x4ba5c0
mov eax, dword [esi + 0xf8]
push eax
jmp 0x4ba5c0
call fcn.005417dc
mov edi, eax
and edi, 0x800000ff
jns 0x4ba57e
dec edi
or edi, 0xffffff00
inc edi
call fcn.005417dc
mov ebx, eax
and ebx, 0x800000ff
jns 0x4ba595
dec ebx
or ebx, 0xffffff00
inc ebx
call fcn.005417dc
and eax, 0x800000ff
jns 0x4ba5a8
dec eax
or eax, 0xffffff00
inc eax
xor ecx, ecx
mov edx, dword [esp + 0x20]
mov ch, al
and edi, 0xff
mov cl, bl
shl ecx, 8
or ecx, edi
mov eax, ecx
push eax
mov eax, dword [esp + 0x520]
mov ecx, dword [esp + 0x51c]
add edx, eax
add ebp, ecx
push edx
mov edx, dword [esp + 0x78]
push ebp
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esi + 0x1d8]
mov ecx, dword [esp + 0x1c]
inc ecx
lea eax, [eax + eax*4]
mov dword [esp + 0x1c], ecx
shl eax, 2
cmp ecx, eax
jle 0x4ba500
lea ecx, [esp + 0x80]
call fcn.00560a62
mov dword [esp + 0x80], vtable.CGdiObject.0
lea ecx, [esp + 0x80]
mov byte [esp + 0x50c], 0xf
call fcn.00560a62
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x6c]
jmp 0x4bb32f
mov edx, dword [esi + 0x1fc]
inc edx
mov eax, edx
mov dword [esi + 0x1fc], edx
cmp eax, 1
jne 0x4ba676
lea eax, [esi + 0x200]
mov ecx, 4
mov edx, dword [esi + 0x1f4]
mov dword [eax], edx
mov edx, dword [esi + 0x1f8]
mov dword [eax + 4], edx
add eax, 8
dec ecx
jne 0x4ba65a
jmp case.0x4ba2ad.9
cmp eax, 2
jne 0x4ba7ed
mov eax, dword [esp + 0x34]
xor edi, edi
cmp eax, 1
jne 0x4ba68f
mov edi, 1
push esi
lea ecx, [esp + 0x3c]
call fcn.00560763
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x5c]
push eax
push ecx
mov dword [esp + 0x514], 0x10
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.CRgn.0
lea edx, [esp + 0x5c]
mov byte [esp + 0x50c], 0x11
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x24]
call fcn.00560a0b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push eax
call fcn.0056005d
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x60]
sub eax, ecx
mov ecx, dword [esp + 0x68]
lea edx, [esi + 0xfc]
sub ecx, ebp
test edx, edx
je 0x4ba70f
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
test edi, edi
je 0x4ba736
mov eax, dword [esi + 0xf4]
jmp 0x4ba73c
mov eax, dword [esi + 0xf8]
mov edx, dword [esi + 0x1dc]
push eax
mov eax, dword [esi + 0x1cc]
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.00560a78
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x12
push ecx
lea ecx, [esp + 0x3c]
call fcn.00560017
mov edx, dword [esp + 0x518]
mov eax, dword [esp + 0x51c]
mov dword [esi + 0x208], edx
mov edx, dword [esp + 0x3c]
lea ecx, [esi + 0x200]
push 4
push ecx
push edx
mov dword [esi + 0x20c], eax
call dword [sym.imp.GDI32.dll_PolyBezier]
lea ecx, [esp + 0x10]
call fcn.00560a62
lea ecx, [esp + 0x20]
call fcn.00560a62
mov edi, vtable.CGdiObject.0
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x13
call fcn.00560a62
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x50c], 0x14
call fcn.00560a62
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x38]
jmp 0x4bb32f
cmp eax, 3
jne case.0x4ba2ad.9
mov eax, dword [esp + 0x34]
xor edi, edi
cmp eax, 1
jne 0x4ba806
mov edi, 1
push esi
lea ecx, [esp + 0x3c]
call fcn.00560763
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x5c]
push eax
push ecx
mov dword [esp + 0x514], 0x15
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.CRgn.0
lea edx, [esp + 0x5c]
mov byte [esp + 0x50c], 0x16
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x24]
call fcn.00560a0b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push eax
call fcn.0056005d
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x60]
sub eax, ecx
mov ecx, dword [esp + 0x68]
lea edx, [esi + 0xfc]
sub ecx, ebp
test edx, edx
je 0x4ba886
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
test edi, edi
je 0x4ba8ad
mov eax, dword [esi + 0xf4]
jmp 0x4ba8b3
mov eax, dword [esi + 0xf8]
mov edx, dword [esi + 0x1dc]
push eax
mov eax, dword [esi + 0x1cc]
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.00560a78
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x17
push ecx
lea ecx, [esp + 0x3c]
call fcn.00560017
mov edx, dword [esp + 0x518]
mov eax, dword [esp + 0x51c]
mov dword [esi + 0x210], edx
mov edx, dword [esp + 0x3c]
lea ecx, [esi + 0x200]
push 4
push ecx
push edx
mov dword [esi + 0x214], eax
call dword [sym.imp.GDI32.dll_PolyBezier]
lea ecx, [esp + 0x10]
call fcn.00560a62
lea ecx, [esp + 0x20]
call fcn.00560a62
mov edi, vtable.CGdiObject.0
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x18
call fcn.00560a62
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x50c], 0x19
call fcn.00560a62
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x38]
jmp 0x4bb32f
cmp dword [esi + 0x228], 1
jl case.0x4ba2ad.9
push esi
lea ecx, [esp + 0x3c]
call fcn.00560763
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x5c]
push eax
push ecx
mov dword [esp + 0x514], 0x1a
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.CRgn.0
lea edx, [esp + 0x5c]
mov byte [esp + 0x50c], 0x1b
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x24]
call fcn.00560a0b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push eax
call fcn.0056005d
mov eax, dword [esp + 0x64]
mov ebp, dword [esp + 0x5c]
mov ecx, dword [esp + 0x68]
mov ebx, dword [esp + 0x60]
lea edx, [esi + 0xfc]
sub eax, ebp
sub ecx, ebx
test edx, edx
je 0x4ba9f1
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esi + 0xf4]
mov eax, dword [esi + 0x1dc]
mov ecx, dword [esi + 0x1cc]
push edx
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00560a78
lea edx, [esp + 0x10]
lea ecx, [esp + 0x38]
push edx
mov byte [esp + 0x510], 0x1c
call fcn.00560017
mov ecx, dword [esi + 0x224]
lea edx, [esp + 0xfc]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ecx
push eax
push edx
lea ecx, [esp + 0x44]
call fcn.0056051c
mov eax, dword [esi + 0x228]
xor edi, edi
test eax, eax
jle 0x4baa8d
mov ecx, dword [esi + 0x224]
mov eax, dword [ecx + edi*8]
mov ecx, dword [ecx + edi*8 + 4]
push ecx
push eax
lea ecx, [esp + 0x40]
call fcn.00560568
mov eax, dword [esi + 0x228]
inc edi
cmp edi, eax
jl 0x4baa6a
mov edx, dword [esp + 0x51c]
mov eax, dword [esp + 0x518]
push edx
push eax
lea ecx, [esp + 0x40]
call fcn.00560568
lea ecx, [esp + 0x10]
call fcn.00560a62
lea ecx, [esp + 0x20]
call fcn.00560a62
mov edi, vtable.CGdiObject.0
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x1d
call fcn.00560a62
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x50c], 0x1e
call fcn.00560a62
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x38]
jmp 0x4bb32f
mov eax, dword [esi + 0x1b4]
test eax, eax
jg 0x4bab7a
mov edx, dword [esp + 0x51c]
mov ecx, dword [esp + 0x518]
lea eax, [esi + 0x184]
mov dword [esi + 0x188], edx
mov dword [esi + 0x190], edx
mov edx, eax
mov dword [eax], ecx
mov dword [esi + 0x18c], ecx
mov edi, dword [edx]
lea ecx, [esi + 0x194]
mov dword [esi + 0x1b4], 0
mov dword [ecx], edi
mov edi, dword [edx + 4]
mov dword [ecx + 4], edi
mov edi, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edx
mov edx, dword [eax]
lea ecx, [esi + 0x1a4]
mov dword [esi + 0x1a4], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
jmp case.0x4ba2ad.9
lea ecx, [esp + 0x10]
push ecx
call ebx
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x194]
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0x38], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x3c], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], eax
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne case.0x4ba2ad.9
push esi
lea ecx, [esp + 0xa4]
call fcn.00560763
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x6c]
mov ebx, 0x1f
push ecx
push edx
mov dword [esp + 0x514], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
sub eax, ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x80], eax
sub ecx, ebp
lea ebp, [esi + 0xfc]
test ebp, ebp
mov dword [esp + 0x20], ecx
jne 0x4bac25
xor edx, edx
jmp 0x4bac28
mov edx, dword [ebp + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
push eax
mov eax, dword [esp + 0xbc]
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004c1380
mov edx, dword [ebp]
push 8
mov ecx, ebp
call dword [edx + 0x24]
push 0xffffff
lea ecx, [esp + 0xc4]
mov dword [esp + 0x54], eax
call fcn.00560ac8
test eax, eax
je 0x4bac73
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x100]
push eax
lea eax, [esi + 0x184]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov dword [esp + 0xc0], vtable.CGdiObject.0
lea ecx, [esp + 0xc0]
mov byte [esp + 0x50c], 0x20
call fcn.00560a62
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov byte [esp + 0x50c], bl
mov ebx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
lea edx, [esi + 0x16c]
sub ecx, ebx
mov ebx, dword [esi + 0x198]
test edx, edx
je 0x4bacd2
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 0x100]
push eax
push ecx
push ebx
push edi
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push edx
call edi
test ebp, ebp
jne 0x4bacf7
xor eax, eax
jmp 0x4bacfa
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x80]
push 0xcc0020
mov edx, dword [esp + 0xa8]
push 0
push 0
push eax
mov eax, dword [esp + 0x30]
push eax
push ecx
push 0
push 0
push edx
call edi
mov eax, dword [esp + 0x50]
or edi, 0xffffffff
test eax, eax
mov dword [esi + 0x1b4], edi
je 0x4bad38
push eax
mov ecx, ebp
call fcn.00560017
mov dword [esp + 0x50c], edi
lea ecx, [esp + 0xa0]
jmp 0x4bb32f
lea eax, [esp + 0x10]
push eax
call ebx
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x194]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x38], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x3c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x44], edx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne case.0x4ba2ad.9
push esi
lea ecx, [esp + 0xa4]
call fcn.00560763
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x6c]
push eax
push ecx
mov dword [esp + 0x514], 0x21
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x70]
sub ebp, eax
mov eax, dword [esp + 0x78]
lea ecx, [esi + 0xfc]
sub eax, ebx
test ecx, ecx
mov dword [esp + 0x20], eax
je 0x4baded
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0xa4]
push 0xcc0020
push 0
push 0
push ecx
push eax
push ebp
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004c1380
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
lea edx, [esi + 0x16c]
sub ecx, ebx
mov ebx, dword [esi + 0x198]
test edx, edx
je 0x4bae36
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push eax
mov eax, dword [esi + 0x100]
push ecx
push ebx
push edi
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push eax
call edi
lea eax, [esi + 0xfc]
test eax, eax
je 0x4bae60
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0xa4]
push 0xcc0020
push 0
push 0
push eax
push ecx
push ebp
push 0
push 0
push edx
call edi
mov ecx, dword [esi + 0x1c4]
or eax, 0xffffffff
mov dword [esi + 0x1bc], ecx
mov dword [esi + 0x1b4], eax
mov dword [esp + 0x50c], eax
lea ecx, [esp + 0xa0]
jmp 0x4bb32f
mov eax, dword [esi + 0x1b4]
test eax, eax
jg 0x4baee5
mov eax, dword [esp + 0x518]
mov ecx, dword [esp + 0x51c]
mov dword [esi + 0x1b4], 0
mov dword [esi + 0x184], eax
mov dword [esi + 0x188], ecx
mov dword [esi + 0x18c], eax
mov dword [esi + 0x190], ecx
jmp case.0x4ba2ad.9
push esi
lea ecx, [esp + 0xec]
call fcn.00560763
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x90]
push edx
push eax
mov dword [esp + 0x514], 0x22
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], vtable.CRgn.0
lea ecx, [esp + 0x90]
mov byte [esp + 0x50c], 0x23
push ecx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0xb8]
call fcn.00560a0b
lea edx, [esp + 0xb4]
lea ecx, [esp + 0xe8]
push edx
call fcn.0056005d
mov ebx, dword [esp + 0x98]
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x94]
sub ebx, edi
lea edi, [esi + 0xfc]
sub ecx, edx
mov dword [esp + 0x80], ebx
test edi, edi
mov dword [esp + 0x50], ecx
jne 0x4baf95
xor eax, eax
jmp 0x4baf98
mov eax, dword [edi + 4]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0xfc]
push ecx
push ebx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x5ed678
lea ecx, [esp + 0x38]
call fcn.0055969a
mov eax, dword [esi + 0x58]
mov byte [esp + 0x50c], 0x24
test eax, eax
je 0x4bafe0
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esi + 0x3c]
call fcn.0055aad3
mov edx, dword [esp + 0x34]
push 0x5ed678
push edx
call fcn.00541319
add esp, 8
test eax, eax
je 0x4baffd
mov ecx, esi
call fcn.004c1380
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esi + 0x184]
mov ecx, dword [esi + 0x184]
mov dword [esp + 0xc8], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0xcc], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xd0], ecx
mov ecx, dword [esp + 0x54]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x58]
push eax
push ecx
lea ecx, [esi + 0x84]
mov dword [esp + 0xdc], edx
call fcn.005671f2
cmp eax, 0xffffffff
je 0x4bb072
cmp eax, 8
je 0x4bb072
mov dword [esi + 0x1b8], eax
jmp 0x4bb2e1
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edx
lea ecx, [esp + 0xcc]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4bb2e1
mov eax, dword [esi + 0xf4]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x30]
cmp dword [esi + 0x1e8], 1
jne 0x4bb0b4
push 1
mov ecx, edi
call fcn.005600f3
jmp 0x4bb0cb
push 2
mov ecx, edi
call fcn.005600f3
mov eax, dword [esi + 0xf8]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x2c]
cmp dword [esi + 0x1e8], 2
jne 0x4bb100
mov edx, dword [edi]
push 8
mov ecx, edi
call dword [edx + 0x24]
mov ebp, eax
mov eax, dword [esi + 0xf8]
push eax
lea eax, [esi + 0x184]
push eax
mov ecx, edi
call fcn.00566b08
test ebp, ebp
je 0x4bb100
push ebp
mov ecx, edi
call fcn.00560017
mov eax, dword [esi + 0x58]
test eax, eax
je 0x4bb281
push 0x5ed678
lea ecx, [esp + 0x20]
call fcn.0055969a
push 0x5ed678
lea ecx, [esp + 0x34]
mov byte [esp + 0x510], 0x25
call fcn.0055969a
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 0x26
push ecx
lea ecx, [esi + 0x3c]
call fcn.0055aad3
mov edx, dword [esp + 0x30]
push 0x5ed678
push edx
call fcn.00541319
add esp, 8
test eax, eax
je 0x4bb25f
mov eax, dword [edi]
lea ecx, [esi + 0x234]
push ecx
mov ecx, edi
call dword [eax + 0x28]
mov edx, dword [esi + 0x58]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xba
push edx
mov dword [esp + 0x30], eax
call ebx
xor ebp, ebp
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4bb233
mov eax, dword [esi + 0x58]
push 0
push ebp
push 0xbb
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push eax
push 0xc1
push ecx
call ebx
test eax, eax
je 0x4bb20d
mov eax, dword [esi + 0x58]
lea edx, [esp + 0x104]
push edx
push ebp
push 0xc4
push eax
mov word [esp + 0x114], 0x3ff
call ebx
lea ecx, [esp + 0x104]
mov byte [esp + eax + 0x104], 0
push ecx
lea ecx, [esp + 0x50]
call fcn.0055969a
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x510], 0x27
call fcn.00559a44
lea ecx, [esp + 0x4c]
mov byte [esp + 0x50c], 0x26
call fcn.0055962c
mov edx, dword [esp + 0x18]
lea eax, [edx - 1]
cmp ebp, eax
je 0x4bb226
push 0x5d7f50
lea ecx, [esp + 0x20]
call fcn.00559a08
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x4bb193
mov eax, dword [esp + 0x1c]
mov ebx, dword [edi]
lea edx, [esi + 0x184]
push 0x10
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov ecx, edi
call dword [ebx + 0x68]
mov ecx, dword [esp + 0x20]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x28]
mov ebx, dword [esp + 0x80]
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 0x25
call fcn.0055962c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50c], 0x24
call fcn.0055962c
lea ebp, [esi + 0x3c]
push 0
mov ecx, ebp
call fcn.0055cf5c
push 0x5ed678
mov ecx, ebp
call fcn.0055ce5b
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [esi + 0x8c]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetRect]
test edi, edi
je 0x4bb2b5
mov edi, dword [edi + 4]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0xec]
push 0xcc0020
push 0
push 0
push edi
push eax
push ebx
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [esi + 0x1b4], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.00560a62
lea ecx, [esp + 0x34]
mov byte [esp + 0x50c], 0x23
call fcn.0055962c
mov dword [esp + 0xb4], vtable.CGdiObject.0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x50c], 0x28
call fcn.00560a62
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.005607d5
mov esi, dword [esi + 0x240]
test esi, esi
je 0x4bb34e
push 0
push 0
push 0x4c2
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x504]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x500
ret 0xc