Function at 0x43f990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a3119
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 8]
call fcn.00437680
xor ebx, ebx
push ebx
push esi
lea ecx, [eax + 0x58]
call fcn.00494f30
mov ecx, dword [0x4d1804]
neg eax
sbb eax, eax
neg eax
cmp ecx, ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x14], ebx
je 0x43f9ef
cmp dword [edi + 4], ebx
jne 0x43f9ef
mov eax, dword [edi + 8]
push eax
call fcn.0043b760
mov dword [esp + 0x14], eax
call fcn.004370a0
cmp dword [esp + 0xc0], ebx
mov ecx, dword [0x4d166c]
mov edx, dword [0x4d1670]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov esi, 1
je 0x43fb57
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x58]
test eax, eax
je 0x43fb64
mov dword [esp + 0x2c], ebx
cmp dword [edi + 0x88], ebx
je 0x43fa44
cmp dword [edi + 0x9c], ebx
jne 0x43fa44
mov dword [esp + 0xc4], esi
mov ecx, dword [edi + 0x8c]
push ecx
push 0x4cd3a0
mov dword [esp + 0xa0], ebx
call fcn.00479229
mov ecx, dword [edi + 8]
mov esi, dword [esp + 0xbc]
add esp, 8
cmp ecx, ebx
je 0x43fa99
cmp ecx, 0xffffffff
je 0x43fa99
cmp dword [edi + 0xa0], ebx
jne 0x43fa99
cmp eax, ebx
je 0x43fa99
cmp dword [eax + 0x6ec], ecx
jne 0x43fa99
mov edx, dword [esi]
push 0x4d0fa4
mov ecx, esi
call dword [edx + 0x28]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0xb8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
call fcn.00404682
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x80]
add dword [esp + 0x30], eax
call fcn.00404682
mov ebp, eax
lea eax, [esp + 0x1c]
push eax
call fcn.00491f60
mov edx, dword [ebp]
add esp, 4
mov ecx, ebp
mov ebx, eax
call dword [edx + 0x80]
mov ebp, dword [ebx]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x3c]
add eax, ebp
add eax, ecx
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.00404682
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x80]
inc eax
cdq
sub eax, edx
sar eax, 1
push 0xffffffffffffffff
push eax
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [0x4cd374]
test eax, eax
je 0x43fb51
mov ecx, dword [edi + 8]
push ecx
call fcn.00495950
add esp, 4
test eax, eax
jne 0x43fb6d
xor ebx, ebx
xor ebp, ebp
jmp 0x43fbbf
test dword [edi + 0xc], 0x40000
je 0x43fa29
mov dword [esp + 0x2c], esi
jmp 0x43fa2d
mov edx, dword [edi + 0x8c]
push edx
xor ebx, ebx
push 0x4cd3a0
xor ebp, ebp
mov dword [esp + 0x58], ebx
call fcn.00479229
add esp, 8
cmp eax, ebp
je 0x43fbc3
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004763c5
push eax
push 0x4cd2bc
call fcn.00479229
add esp, 8
cmp eax, ebp
je 0x43fbc3
mov ecx, eax
call fcn.00424c70
test eax, eax
je 0x43fbc3
mov ebx, 1
mov dword [esp + 0x50], ebx
cmp dword [esp + 0xc4], ebp
mov dword [esp + 0x18], ebp
jne 0x43fbe2
call fcn.00404682
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x40], 1
jne 0x43fbe6
mov dword [esp + 0x40], ebp
cmp ebx, ebp
je 0x43fc25
cmp dword [esp + 0xc4], ebp
mov dword [esp + 0x18], 1
mov ecx, 0x110000
je 0x43fc09
test dword [edi + 0xc], ecx
je 0x43fc09
mov dword [esp + 0x18], ebp
cmp dword [edi + 4], ebp
je 0x43fc13
mov eax, dword [edi + 0x44]
jmp 0x43fc16
mov eax, dword [edi + 0x40]
cmp eax, ebp
jge 0x43fc40
test dword [edi + 0xc], ecx
jne 0x43fc40
mov dword [esp + 0x18], ebp
jmp 0x43fc40
test dword [edi + 0xc], 0x110000
je 0x43fc40
mov eax, dword [esp + 0xc4]
xor ecx, ecx
cmp eax, ebp
sete cl
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 0x18]
cmp ecx, ebp
je 0x43fc58
cmp dword [edi + 4], ebp
je 0x43fc51
mov eax, dword [edi + 0x44]
jmp 0x43fc54
mov eax, dword [edi + 0x40]
cmp eax, ebp
jge 0x43fc79
mov eax, dword [edi + 4]
mov edx, 1
mov dword [edi + 0x18], edx
mov dword [edi + 4], edx
cmp dword [edi + 0x44], ebp
jge 0x43fc79
cmp dword [edi + 0x40], ebp
mov dword [edi + 4], ebp
jge 0x43fc79
mov dword [edi + 0x18], ecx
mov dword [edi + 4], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x9c], vtable.CRgn.0
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0xb0], ebp
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0xa0]
call fcn.0047d105
cmp dword [esp + 0x54], ebp
jne 0x43ffbe
cmp dword [edi + 0x18], ebp
je 0x43ffbe
cmp dword [edi + 4], ebp
je 0x43fccd
mov eax, dword [edi + 0x44]
jmp 0x43fcd0
mov eax, dword [edi + 0x40]
cmp eax, ebp
jl 0x43ffbe
cmp dword [esp + 0xbc], ebp
je 0x43ffbe
cmp dword [esp + 0xc4], ebp
je 0x43fd12
cmp dword [esp + 0xc0], ebp
jne 0x43fd12
call fcn.00404682
cmp dword [eax + 0x10], ebp
je 0x43fd12
test dword [edi + 0xc], 0x50000
mov dword [esp + 0x10], 1
je 0x43fd16
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x9c]
push eax
mov ecx, esi
call fcn.0047c975
mov ecx, dword [esp + 0xc4]
push ecx
lea edx, [esp + 0x6c]
push edx
push esi
mov ecx, edi
call fcn.00446960
mov ebp, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x1c]
push eax
sub ebp, edx
call fcn.00491f60
mov ecx, eax
mov edx, dword [ecx + 4]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
sub eax, edx
sub eax, ecx
cdq
sub eax, edx
lea edx, [esp + 0x48]
mov ebx, eax
push edx
sar ebx, 1
call fcn.00491f60
mov ecx, eax
mov edx, dword [ecx]
mov eax, ebp
sub eax, edx
cdq
sub eax, edx
mov ebp, eax
mov eax, dword [edi + 0xc]
add esp, 8
sar ebp, 1
test eax, 0x10000
mov dword [esp + 0x48], ebx
je 0x43fdad
mov eax, dword [esp + 0xc0]
test eax, eax
jne 0x43fdad
call fcn.00404682
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x43fdad
inc ebp
inc ebx
mov dword [esp + 0x48], ebx
mov eax, dword [edi + 0xc]
test eax, 0x20000
jne 0x43fdd8
test eax, 0x40000
je 0x43fdd8
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x43fdd8
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x43fec1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43fe27
lea eax, [esp + 0x1c]
push eax
call fcn.00491f60
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x4c]
add ecx, edx
mov edx, dword [esp + 0x34]
add eax, ecx
add esp, 4
mov dword [esp + 0x60], eax
add edx, ebp
lea eax, [esp + 0x54]
push eax
add ebx, edx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x18]
push esi
mov dword [esp + 0x5c], edx
mov dword [esp + 0x64], ebx
call fcn.0044a730
jmp 0x43fea5
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
lea ecx, [eax + ebp]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], ecx
add ebx, dword [esp + 0x48]
test eax, eax
je 0x43fe78
mov eax, dword [edi + 4]
test eax, eax
je 0x43fe52
mov eax, dword [edi + 0x44]
jmp 0x43fe55
mov eax, dword [edi + 0x40]
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0xbc]
push 0
push 1
push 0
push 0
push 0
push eax
push ebx
push edx
push esi
call fcn.00438f20
dec dword [esp + 0x54]
dec ebx
mov eax, dword [edi + 4]
test eax, eax
je 0x43fe84
mov eax, dword [edi + 0x44]
jmp 0x43fe87
mov eax, dword [edi + 0x40]
mov ecx, dword [esp + 0xbc]
push 0
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x6c]
push ebx
push eax
push esi
call fcn.00438f20
mov eax, dword [esp + 0xc0]
test eax, eax
jne 0x43ffb0
test dword [edi + 0xc], 0x20000
jne 0x43ffb0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43ff08
lea ecx, [esp + 0x1c]
push ecx
call fcn.00491f60
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x4c]
add ecx, edx
mov edx, dword [esp + 0x34]
add esp, 4
add ebp, edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push ecx
push ebp
lea ecx, [esp + 0x64]
call fcn.0040e44e
mov ecx, dword [esp + 0x14]
push eax
push esi
call fcn.0044a730
jmp 0x43ffb0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43ff59
mov eax, dword [edi + 4]
test eax, eax
je 0x43ff1c
mov eax, dword [edi + 0x44]
jmp 0x43ff1f
mov eax, dword [edi + 0x40]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x48]
push 0
push 1
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
add ecx, edx
push ecx
lea ecx, [eax + ebp]
push ecx
mov ecx, dword [esp + 0xdc]
push esi
call fcn.00438f20
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x43ff73
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x43ff73
mov ecx, 1
jmp 0x43ff75
xor ecx, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x43ff81
mov eax, dword [edi + 0x44]
jmp 0x43ff84
mov eax, dword [edi + 0x40]
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x34]
push 0
push 0
push ecx
mov ecx, dword [esp + 0x58]
push 0
push eax
mov eax, dword [esp + 0x4c]
add eax, ecx
mov ecx, dword [esp + 0xd4]
push eax
add ebp, edx
push ebp
push esi
call fcn.00438f20
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0x10]
xor ebp, ebp
cmp dword [0x4d1818], ebp
jne 0x43ffd0
cmp ebx, ebp
jne 0x4400a2
xor ebp, ebp
mov ecx, dword [edi + 0x8c]
cmp ecx, ebp
jne 0x44000c
call fcn.00474440
cmp eax, ebp
je 0x43fffa
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push eax
push 0x4a9ff4
call fcn.00479229
add esp, 8
jmp 0x44001b
xor eax, eax
push eax
push 0x4a9ff4
call fcn.00479229
add esp, 8
jmp 0x44001b
mov ebp, dword [0x4d1810]
test ebp, ebp
jne 0x44001d
call fcn.00476d6c
mov ebp, eax
push ebp
push 0x4b3170
call fcn.00479229
add esp, 8
test eax, eax
je 0x440042
mov edx, dword [eax]
lea ecx, [esp + 0x30]
push ecx
push edi
push esi
mov ecx, eax
call dword [edx + 0x184]
jmp 0x44009c
push ebp
push 0x4b09a0
call fcn.00479229
add esp, 8
test eax, eax
je 0x440067
mov edx, dword [eax]
lea ecx, [esp + 0x30]
push ecx
push edi
push esi
mov ecx, eax
call dword [edx + 0x178]
jmp 0x44009c
push ebp
push 0x4b2eb0
call fcn.00479229
add esp, 8
test eax, eax
jne 0x44008b
push ebp
push 0x4b2c18
call fcn.00479229
add esp, 8
test eax, eax
je 0x4400a2
mov edx, dword [eax]
lea ecx, [esp + 0x30]
push ecx
push edi
mov ecx, eax
push esi
call dword [edx + 0x198]
mov ebx, eax
mov dword [esp + 0x10], ebx
push 0
mov ecx, esi
call fcn.0047cc32
mov edx, dword [esp + 0x38]
mov eax, dword [edi + 0xc]
inc edx
and eax, 0x10000
mov dword [esp + 0x38], edx
je 0x4401ab
test ebx, ebx
jne 0x4401af
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
push 0xffffffffffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x40]
push ebx
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x440119
mov eax, dword [esp + 0x50]
test eax, eax
je 0x440119
push 0x4d0f64
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040dcf9
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x78]
sub eax, edx
sub eax, ebp
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x24]
sub eax, ebx
sar ecx, 1
add ecx, ebp
mov ebp, dword [esp + 0x1c]
sub eax, ebp
cdq
sub eax, edx
sar eax, 1
add eax, ebp
mov ebp, dword [edi + 0xa8]
mov dword [esp + 0x54], eax
test dword [edi + 0xc], 0x40000
mov dword [esp + 0x58], ecx
je 0x44016c
neg ebp
sbb ebp, ebp
and ebp, 0x10
add ebp, 7
jmp 0x440176
neg ebp
sbb ebp, ebp
and ebp, 0x10
add ebp, 6
mov edx, dword [esp + 0xc4]
push edx
lea eax, [esp + 0x20]
push eax
push esi
mov ecx, edi
call fcn.00446960
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x58]
push edx
xor eax, eax
push ebp
push esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
call fcn.00437180
add esp, 0x10
jmp 0x4401cf
test ebx, ebx
je 0x440208
mov ecx, dword [esp + 0xc4]
test ecx, ecx
je 0x4401c7
test eax, eax
jne 0x4401c7
call fcn.00404682
push 2
jmp 0x4401d6
test ebx, ebx
je 0x440208
test eax, eax
je 0x440208
call fcn.00404682
push 1
mov ebx, dword [esp + 0x6c]
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], ebx
mov ebx, dword [esp + 0x80]
mov dword [ecx + 4], ebx
mov ebx, dword [esp + 0x84]
mov dword [ecx + 8], ebx
mov ebx, dword [esp + 0x88]
push edi
mov dword [ecx + 0xc], ebx
mov ecx, eax
push esi
call dword [edx + 0x4c]
mov eax, dword [esp + 0x10]
or ebx, 0xffffffff
test eax, eax
jne 0x44038f
mov eax, dword [edi + 8]
cmp eax, 0xf060
ja 0x440263
je 0x440253
sub eax, 0xf020
je 0x440243
sub eax, 0x10
jne 0x44038f
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
test ecx, ecx
setne bl
add ebx, 0xe
jmp 0x44027c
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
test ecx, ecx
setne bl
add ebx, 8
jmp 0x44027c
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
test ecx, ecx
setne bl
add ebx, 0xc
jmp 0x44027c
cmp eax, 0xf120
jne 0x44038f
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
test ecx, ecx
setne bl
add ebx, 0xa
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
je 0x44038f
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call fcn.00404682
mov ebp, eax
call fcn.00404682
mov ebx, eax
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x80]
mov edx, dword [ebx]
mov ecx, ebx
mov ebp, eax
call dword [edx + 0x80]
neg ebp
push ebp
neg eax
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x7c]
sub eax, ebx
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x78]
mov ecx, eax
mov eax, dword [esp + 0x24]
sar ecx, 1
add ecx, ebx
mov ebx, dword [esp + 0x1c]
sub eax, ebx
sub eax, edx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
mov ebx, dword [esp + 0xc4]
mov dword [esp + 0x58], ecx
push ebx
lea ecx, [esp + 0x6c]
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x60], eax
call fcn.00446960
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x58]
push eax
push ecx
xor ebp, ebp
push esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
call fcn.00437180
add esp, 0x10
cmp ebx, ebp
je 0x44038b
call fcn.00404682
mov ebx, dword [esp + 0x68]
mov edx, dword [eax]
push 2
sub esp, 0x10
mov ecx, esp
mov dword [ecx], ebx
mov ebx, dword [esp + 0x80]
mov dword [ecx + 4], ebx
mov ebx, dword [esp + 0x84]
mov dword [ecx + 8], ebx
mov ebx, dword [esp + 0x88]
push edi
mov dword [ecx + 0xc], ebx
push esi
mov ecx, eax
call dword [edx + 0x4c]
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0xb8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x88], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x8c], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
call fcn.00404682
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x80]
mov ecx, dword [esp + 0x70]
lea edx, [ecx + eax*2]
lea eax, [eax + edx - 4]
mov edx, dword [esp + 0xc4]
test edx, edx
mov dword [esp + 0x88], eax
je 0x440473
mov edx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x68]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x28], ecx
test dword [edi + 0xc], 0x10000
mov dword [esp + 0x20], edx
jne 0x44041b
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x44041b
cmp ebx, 0xffffffff
je 0x44041e
lea ebp, [eax - 1]
mov edx, dword [esp + 0xb8]
mov ebx, dword [edx + 8]
mov eax, dword [esp + 0x2c]
dec ebx
test eax, eax
je 0x44043c
mov eax, dword [0x4d0f38]
mov dword [esp + 0x64], eax
jmp 0x440446
mov ecx, dword [0x4d0f5c]
mov dword [esp + 0x64], ecx
call fcn.00404682
mov edx, dword [eax]
lea ecx, [esp + 0x64]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], ebp
mov ebp, dword [esp + 0x34]
mov dword [ecx + 4], ebp
mov dword [ecx + 8], ebx
mov ebx, dword [esp + 0x3c]
push edi
mov dword [ecx + 0xc], ebx
push esi
mov ecx, eax
call dword [edx + 0x50]
jmp 0x440490
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x440487
mov edx, dword [0x4d0f54]
mov dword [esp + 0x64], edx
jmp 0x440490
mov eax, dword [0x4d0f44]
mov dword [esp + 0x64], eax
mov eax, dword [edi + 0x10]
lea ebp, [edi + 0x10]
sub eax, 0x10
push eax
call fcn.00405b19
lea ebx, [eax + 0x10]
add esp, 4
mov dword [esp + 0x10], ebx
mov byte [esp + 0xac], 1
call fcn.004787a0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [ebp]
mov ecx, dword [eax - 0xc]
test ecx, ecx
mov byte [esp + 0xac], 2
jle 0x44058d
push 9
push eax
call fcn.00410521
add esp, 8
test eax, eax
je 0x44058d
sub eax, dword [ebp]
mov dword [esp + 0x54], eax
js 0x44058d
mov ebx, eax
push ebx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
call fcn.0040cc65
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xb0], 3
call fcn.00406118
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov byte [esp + 0xac], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440543
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
inc ebx
push ebx
lea eax, [esp + 0x58]
push eax
mov ecx, ebp
call fcn.0040cd1e
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb0], 4
call fcn.00406118
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov byte [esp + 0xac], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440589
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x10]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextColor]
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x44], eax
mov eax, dword [edi + 0x20]
add ecx, 3
test eax, eax
mov dword [esp + 0x88], ecx
jne 0x440731
push 0x4add48
lea ecx, [esp + 0x54]
call fcn.00402ca3
mov eax, dword [ebx - 0xc]
test eax, eax
mov byte [esp + 0xac], 5
jle 0x4406f5
jmp 0x4405e0
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x5c]
push eax
call fcn.0048f406
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x90]
mov ebp, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x54]
cmp ebp, ecx
setg byte [esp + 0x4f]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x440646
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, byte [esp + 0x4f]
test al, al
je 0x4406f5
mov eax, dword [ebx - 0xc]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.0040cc65
mov eax, dword [eax]
lea ecx, [eax - 0x10]
lea ebp, [ebx - 0x10]
cmp ecx, ebp
mov byte [esp + 0xac], 6
je 0x4406c4
mov edx, dword [ebp + 0xc]
test edx, edx
lea ebx, [ebp + 0xc]
jge 0x440697
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00402bd1
mov ebx, dword [esp + 0x10]
jmp 0x4406c4
push ecx
call fcn.00405b19
add esp, 4
mov dword [esp + 0x40], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x4406b9
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov ebx, dword [esp + 0x40]
add ebx, 0x10
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xac], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4406ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [ebx - 0xc]
test eax, eax
jg 0x4405e0
mov eax, dword [esp + 0x50]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0040cbd3
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0xac], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x44072d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x4407a0
mov eax, dword [esp + 0xc4]
test eax, eax
jne 0x4407a0
mov ecx, dword [0x4d0f40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x90]
push 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x98]
push 1
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebx - 0xc]
mov edx, dword [esi]
push 0x24
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esp + 0x64]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [ebx - 0xc]
mov edx, dword [esi]
push 0x24
lea ecx, [esp + 0x8c]
push ecx
push eax
push ebx
mov ecx, esi
call dword [edx + 0x68]
mov edx, dword [esp + 0x18]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x44089a
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
sub eax, dword [esp + 0x78]
sub eax, 3
test ebp, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
je 0x440877
mov eax, dword [esp + 0xc4]
test eax, eax
jne 0x440877
mov ecx, dword [0x4d0f40]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push 1
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], edx
mov edx, dword [esp + 0x2c]
push 1
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
mov edx, dword [esi]
push 0x26
lea ebp, [esp + 0x7c]
push ebp
push eax
push ecx
mov ecx, esi
call dword [edx + 0x68]
mov ecx, dword [esp + 0x64]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
mov edx, dword [esi]
push 0x26
lea ebp, [esp + 0x20]
push ebp
push eax
push ecx
mov ecx, esi
call dword [edx + 0x68]
cmp dword [edi + 8], 0xffffffff
je 0x4408b8
mov eax, dword [edi + 0x80]
test eax, eax
jne 0x4408b8
mov eax, dword [edi + 0xa0]
test eax, eax
je 0x440949
mov eax, dword [esi]
push 0x4d0fc4
mov ecx, esi
call dword [eax + 0x28]
mov edi, eax
mov eax, dword [esp + 0xb8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x7c], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x80], ecx
push 0x4b2a3c
lea ecx, [esp + 0x44]
mov dword [esp + 0x88], edx
call fcn.00402ca3
mov eax, dword [esp + 0x40]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi]
push 0x26
lea ebp, [esp + 0x7c]
push ebp
push ecx
push eax
mov ecx, esi
mov byte [esp + 0xbc], 7
call dword [edx + 0x68]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x28]
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0xac], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440949
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x98]
test eax, eax
je 0x44095c
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x28]
mov ecx, dword [esp + 0x44]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0xac], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x44098e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebx, 0xfffffff0
mov byte [esp + 0xac], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4409b0
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
lea ecx, [esp + 0x9c]
mov dword [esp + 0xac], 0xffffffff
mov dword [esp + 0x9c], vtable.CGdiObject.0
call fcn.0047d15c
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xa0
ret 0x18