Function at 0x476660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x489c7b
mov eax, dword fs:[0]
push eax
sub esp, 0x510
mov eax, dword [0x49e7c0]
xor eax, esp
mov dword [esp + 0x50c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49e7c0]
xor eax, esp
push eax
lea eax, [esp + 0x524]
mov dword fs:[0], eax
mov eax, dword [esp + 0x53c]
cmp eax, 0xf
mov ebx, dword [esp + 0x538]
mov edi, dword [esp + 0x534]
mov dword [esp + 0x28], ebx
je 0x476a1d
cmp eax, 0x7b
je 0x4767ff
cmp eax, 0x111
mov ecx, dword [esp + 0x540]
jne 0x47676c
movzx edx, cx
cmp edx, 0x2719
mov dword [esp + 0x28], edx
je 0x476782
cmp edx, 0x271e
jle 0x47676c
cmp edx, 0x2720
jg 0x47676c
mov ecx, edi
mov esi, 1
xor ebx, ebx
call fcn.00420340
push esi
mov ecx, edi
mov ebp, eax
call fcn.004202e0
test eax, eax
je 0x47672c
cmp eax, ebp
jne 0x47671d
mov ebx, esi
add esi, 1
push esi
mov ecx, edi
call fcn.004202e0
test eax, eax
jne 0x476717
cmp dword [esp + 0x28], 0x271f
jne 0x47673b
add ebx, 1
jmp 0x47673e
sub ebx, 1
cmp ebx, 1
jge 0x476746
lea ebx, [esi - 1]
cmp ebx, esi
jl 0x476755
mov ebx, 1
cmp esi, ebx
jg 0x476755
xor ebx, ebx
mov ecx, dword [edi + 0x10]
push ebx
call fcn.004202e0
mov ecx, dword [edi + 0x10]
push eax
call fcn.004203b0
jmp 0x477306
mov edx, dword [esp + 0x544]
push edx
push ecx
push eax
push ebx
push edi
call fcn.00420d70
jmp 0x477308
mov ecx, edi
call fcn.00420340
mov ebx, 1
push ebx
mov ecx, edi
mov esi, eax
call fcn.004202e0
test eax, eax
je 0x4767b9
lea esp, [esp]
cmp eax, esi
jne 0x4767b5
add ebx, 1
push ebx
mov ecx, edi
call fcn.004202e0
test eax, eax
jne 0x4767a0
jmp 0x4767b9
test eax, eax
jne 0x4767c2
push 0
mov ecx, edi
call fcn.004202e0
push eax
mov ecx, edi
call fcn.004203b0
mov ecx, dword [esi + 0x38]
mov edx, dword [esi]
mov edx, dword [edx + 0x38]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esi + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x40]
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0x44]
mov dword [eax + 0xc], ecx
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push 1
mov ecx, esi
call edx
jmp 0x477306
mov eax, dword [0x4a1388]
push 0x12e
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
mov ebp, 1
cmp dword [edi + 0x2c], ebp
mov esi, eax
je 0x476835
cmp dword [edi + 0x30], 4
je 0x476871
mov edx, dword [edi]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0x5c]
push eax
push 0x12
mov ecx, edi
call edx
test eax, eax
je 0x476871
push 0x400
push 0xb
push esi
call ebx
push 0x400
push 0xb
push esi
call ebx
push 0x400
push 0xb
push esi
call ebx
push 0x400
push 0xb
push esi
call ebx
cmp dword [edi + 0x2c], ebp
jne 0x476984
mov ebp, 4
nop
push 0x400
push 2
push esi
call ebx
sub ebp, 1
jne 0x476880
mov ebx, dword [sym.imp.USER32.dll_GetMenuItemInfoW]
lea ecx, [esp + 0xb0]
push ecx
push 0
push 0x2716
lea eax, [esp + 0x12c]
push esi
mov dword [esp + 0xc0], 0x30
mov dword [esp + 0xc4], 0x11
mov dword [esp + 0xc8], 0
mov dword [esp + 0xe8], 0x400
mov dword [esp + 0xe4], eax
call ebx
mov edx, dword [edi + 0x2c]
mov ebp, dword [sym.imp.USER32.dll_SetMenuItemInfoW]
neg edx
lea eax, [esp + 0xb0]
push eax
sbb edx, edx
or dword [esp + 0xbc], 0x200
push 0
and edx, 0xfffffff8
push 0x2716
add edx, 8
push esi
mov dword [esp + 0xcc], edx
call ebp
lea edx, [esp + 0xb0]
push edx
push 0
push 0x2715
lea ecx, [esp + 0x12c]
push esi
mov dword [esp + 0xc8], 0
mov dword [esp + 0xe8], 0x400
mov dword [esp + 0xe4], ecx
call ebx
mov eax, dword [edi + 0x2c]
sub eax, 1
neg eax
lea ecx, [esp + 0xb0]
push ecx
sbb eax, eax
or dword [esp + 0xbc], 0x200
push 0
and eax, 0xfffffff8
push 0x2715
add eax, 8
push esi
mov dword [esp + 0xcc], eax
call ebp
jmp 0x47699f
mov ebp, 9
lea esp, [esp]
push 0x400
push 0
push esi
call ebx
sub ebp, 1
jne 0x476990
mov eax, dword [esp + 0x544]
movsx ebx, ax
shr eax, 0x10
cmp ebx, 0xffffffff
movsx ebp, ax
je 0x4769b9
cmp ebp, 0xffffffff
jne 0x4769da
xor eax, eax
lea edx, [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [edi + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
mov ecx, edi
call fcn.00420340
cmp edi, eax
je 0x4769f9
mov ecx, edi
call fcn.00420340
mov eax, dword [eax + 4]
jmp 0x4769fd
mov eax, dword [esp + 0x28]
push 0
push eax
push 0
push ebp
push ebx
push 0
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x477306
lea eax, [esp + 0xe0]
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
lea ecx, [esp + 0x90]
push ecx
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea edx, [esp + 0xe8]
push edx
call ebp
mov ebx, eax
mov ecx, edi
mov dword [esp + 0x6c], ebx
call fcn.00420340
lea ecx, [esp + 0x80]
mov dword [esp + 0x58], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
push ecx
push 9
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x70]
push ecx
push 4
mov ecx, edi
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x38]
push ecx
push 5
mov ecx, edi
call edx
lea eax, [esp + 0x80]
push eax
call ebp
lea ecx, [esp + 0x70]
mov ebp, eax
push ecx
mov dword [esp + 0x34], ebp
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 4
push ebp
push ebx
push ebx
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [esp + 0x2c]
push 4
push eax
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ecx, dword [esp + 0x1c]
push 4
push ecx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edx, dword [esp + 0x58]
cmp dword [0x4a000c], edx
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
jne 0x476b09
push 2
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 9
jmp 0x476b16
push 3
call ebx
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x13
mov dword [esp + 0x18], eax
call ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x2c]
push 4
push ecx
push ebp
push ebp
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edx, dword [esp + 0x1c]
push 4
push edx
push ebp
push ebp
call dword [sym.imp.GDI32.dll_CombineRgn]
cmp dword [edi + 0x6c], 0
je 0x476c9d
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x50], edx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ecx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 4
push eax
push ebp
push ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x50]
sub eax, dword [esp + 0x48]
mov cl, 0xf
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0x6c]
cmp eax, 3
jg 0x476bdf
imul cl
sub al, 0x60
movzx edx, al
shl edx, 0x10
or edx, 0x4020
jmp 0x476c00
cmp eax, 8
jge 0x476bf5
sub al, 4
imul cl
sub al, 0x60
movzx edx, al
or edx, 0x204000
jmp 0x476c00
imul cl
movzx edx, al
or edx, 0xa04000
push edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x64], edx
mov edx, dword [edi + 0x68]
imul edx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x68], eax
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, ecx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x60]
push edx
push esi
mov dword [esp + 0x70], eax
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x804020
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x50]
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x60]
push eax
push esi
mov dword [esp + 0x68], ecx
mov dword [esp + 0x70], edx
call dword [sym.imp.USER32.dll_FillRect]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x14]
push edx
push ebp
push esi
call dword [sym.imp.GDI32.dll_FillRgn]
mov eax, dword [esp + 0x88]
sub eax, dword [esp + 0x80]
test eax, eax
jle 0x476d0a
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov ebp, dword [esp + 0x38]
add eax, 0xfffffffe
sub esp, 0x10
add ecx, 2
mov dword [esp + 0x78], eax
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x78]
add edx, 2
add ebp, 0xfffffffe
mov dword [eax + 4], edx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ecx
push esi
mov ecx, edi
call fcn.00475d80
mov edx, dword [esp + 0x20]
push edx
push esi
call ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x58]
cmp dword [0x4a000c], ecx
jne 0x476d35
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
push 2
jmp 0x476d3f
push 0x13
call dword [sym.imp.USER32.dll_GetSysColor]
push 3
mov ebp, eax
call dword [sym.imp.USER32.dll_GetSysColor]
cmp dword [edi + 0x84], 4
mov dword [esp + 0x14], eax
jne 0x476d7f
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [esp + 0x14]
push 0x2020
push edx
mov ebp, eax
call fcn.0041fa20
push 0x200000
push eax
call fcn.0041f990
add esp, 0x10
mov dword [esp + 0x14], eax
push ebp
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
mov ebp, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push ebp
push esi
mov dword [esp + 0x1c], eax
call ebx
mov ecx, dword [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x28], eax
call ebx
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x74]
push edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x7c]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
cmp dword [edi + 0x84], 4
jne 0x476de2
push 1
push 1
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x70]
push 0
add ecx, 2
push ecx
add edx, 2
push edx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x78]
add eax, 0xfffffffe
push eax
add ecx, 0xfffffffe
push ecx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
push 0
add edx, 2
push edx
add eax, 0xfffffffd
push eax
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x70]
add ecx, 0xfffffffe
push ecx
add edx, 1
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [esp + 0x20]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x24]
push ecx
push esi
call ebx
push ebp
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
mov edx, dword [esp + 0x14]
push edx
call ebp
mov eax, dword [esp + 0x58]
cmp dword [0x4a000c], eax
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
jne 0x476e7c
push 9
call ebp
push 2
jmp 0x476e82
push 0x13
call ebp
push 3
mov dword [esp + 0x18], eax
call ebp
cmp dword [edi + 0x84], 5
mov ebp, eax
jne 0x476eba
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x2020
push ebp
mov dword [esp + 0x1c], eax
call fcn.0041fa20
push 0x200000
push eax
call fcn.0041f990
add esp, 0x10
mov ebp, eax
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [esp + 0x14]
push edx
mov ebp, eax
push esi
mov dword [esp + 0x20], ebp
call ebx
push ebp
push esi
mov dword [esp + 0x28], eax
call ebx
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
cmp dword [edi + 0x84], 5
jne 0x476f21
push 1
push 1
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
sub eax, ecx
sub eax, 5
cdq
sub eax, edx
mov edx, dword [esp + 0x44]
mov ebp, eax
sar ebp, 1
push 0
sub edx, ebp
sub edx, 6
push edx
add ecx, 2
push ecx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
sub eax, ebp
sub eax, 6
push eax
add ecx, 0xfffffffe
push ecx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
push 0
add edx, 0xfffffffb
add eax, ecx
push edx
cdq
sub eax, edx
sar eax, 1
push eax
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
sub edx, ebp
sub edx, 6
push edx
add eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
lea eax, [eax + edx - 1]
cdq
push 0
add ecx, 0xfffffffb
sub eax, edx
push ecx
sar eax, 1
push eax
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x38]
sub ecx, ebp
sub ecx, 6
push ecx
add edx, 1
push edx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [esp + 0x20]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x24]
push ecx
push esi
call ebx
mov edx, dword [esp + 0x14]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x30]
push ecx
call ebp
mov edx, dword [esp + 0x2c]
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebp
mov ecx, dword [esp + 0x6c]
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov edx, dword [edi]
mov edx, dword [edx + 0x18]
lea eax, [esp + 0xa0]
push eax
push 0x12
mov ecx, edi
call edx
test eax, eax
jne 0x47727d
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
push 0x10
call ebp
push eax
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push 4
mov dword [esp + 0x30], eax
call ebp
mov ebp, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
call ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x58]
cmp dword [0x4a000c], eax
jne 0x477075
push 2
jmp 0x477077
push 3
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call ebp
mov ecx, dword [esp + 0x2c]
push ecx
push esi
mov dword [esp + 0x28], eax
call ebx
mov edx, dword [esp + 0x1c]
push edx
push esi
mov dword [esp + 0x2c], eax
call ebx
push 1
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0
mov ecx, edi
mov dword [esp + 0x18], 0
call fcn.004202e0
mov ebp, eax
test ebp, ebp
je 0x47724b
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
lea ecx, [esp + 0x48]
push ecx
add edx, 0x13
push edx
mov ecx, edi
call eax
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push 4
push eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 8]
test eax, eax
je 0x477138
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x477138
mov eax, dword [esp + 0x58]
cmp dword [0x4a000c], eax
jne 0x477121
push 9
jmp 0x477123
push 0x13
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x20]
push ecx
jmp 0x47714d
push 7
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push ecx
push edx
push eax
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
xor eax, eax
mov dword [esp + 0xc8], 7
mov dword [esp + 0xc4], eax
mov word [esp + 0xb4], ax
push 0xffffffffffffffff
push eax
lea ecx, [ebp + 0x4c]
push ecx
lea ecx, [esp + 0xbc]
mov dword [esp + 0x538], eax
call fcn.00402360
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x4c]
sub dword [esp + 0x68], 2
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x50]
add eax, 2
sub esp, 0x10
mov dword [esp + 0x70], eax
mov eax, esp
add ecx, 2
mov dword [eax], ecx
mov ecx, dword [esp + 0x70]
sub edx, 2
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edx, dword [esp + 0x78]
push esi
mov ecx, ebp
mov dword [eax + 0xc], edx
call fcn.00475d80
add dword [esp + 0x14], 1
cmp dword [esp + 0xc8], 8
mov dword [esp + 0x52c], 0xffffffff
jb 0x477219
mov eax, dword [esp + 0xb4]
push eax
call fcn.004775de
add esp, 4
mov ecx, dword [esp + 0x14]
xor eax, eax
push ecx
mov ecx, edi
mov dword [esp + 0xcc], 7
mov dword [esp + 0xc8], eax
mov word [esp + 0xb8], ax
call fcn.004202e0
mov ebp, eax
test ebp, ebp
jne 0x4770c0
mov edx, dword [esp + 0x24]
push edx
push esi
call ebx
mov eax, dword [esp + 0x18]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push ecx
call edi
mov edx, dword [esp + 0x1c]
push edx
call edi
mov eax, dword [esp + 0x6c]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov ebp, edi
push 0x10
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
push 0xf
mov edi, eax
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push edi
push esi
mov dword [esp + 0x38], eax
call ebx
mov ecx, dword [esp + 0x30]
push ecx
push esi
mov dword [esp + 0x28], eax
call ebx
mov edx, dword [esp + 0x9c]
mov ecx, dword [esp + 0x94]
push edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x9c]
push eax
push ecx
push edx
push esi
call dword [sym.imp.GDI32.dll_Rectangle]
mov eax, dword [esp + 0x20]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x30]
push ecx
push esi
call ebx
push edi
call ebp
mov edx, dword [esp + 0x6c]
push edx
call ebp
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0xe0]
push eax
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov ecx, dword [esp + 0x524]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50c]
xor ecx, esp
call fcn.004777ea
add esp, 0x51c
ret 0x14