Function at 0x422070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x455bfc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe0
push ebx
push ebp
mov ebp, ecx
mov ecx, 0x46a8a8
call fcn.00438030
mov ebx, eax
mov ecx, 0x46a8a8
mov dword [esp + 0x14], ebx
call fcn.004369c0
test eax, eax
je 0x422dba
test ebx, ebx
mov dword [eax + 0x142a4], 0
jne 0x422131
mov ecx, dword [ebp + 0x6a90]
test ecx, ecx
jle 0x422dba
mov ecx, dword [0x46a9c4]
test ecx, ecx
jle 0x422dba
mov ecx, dword [eax + 0x142cc]
test ecx, ecx
jne 0x422dba
push ebx
push ebx
mov dword [eax + 0x142a4], 1
mov ecx, dword [0x46af64]
mov edx, dword [0x46af54]
push ebx
push ebx
lea eax, [ebp + 0x6a84]
push ebx
push eax
push ecx
push edx
push ebx
lea ecx, [ebp + 0x70d0]
call dword [sym.imp.2DEngineDll.dll_public:_void___thiscall_IXHandler::_mimage::bitblt_int__int__int__class_IXHandler::_mimage___int__enum_IXHandler::_mimage::Align_Style__bool__struct_tagRECT___struct_IXHandler::_mimage::_mimage_blt_fx_const__]
pop ebp
pop ebx
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
add esp, 0xec
ret
push esi
push edi
mov ecx, ebp
mov dword [eax + 0x142cc], 0x3c
call fcn.00422de0
mov ecx, dword [ebp + 0x70bc]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, ebp
call fcn.00424070
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
test eax, eax
mov eax, esi
je 0x422194
sub eax, edi
mov edx, eax
shl edx, 5
add edx, eax
lea ecx, [eax + edx*4]
mov eax, 0xb19ab5c5
shl ecx, 1
imul ecx
add edx, ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
sub edx, esi
lea ecx, [edx + edi - 0x30]
jmp 0x4221bb
sub eax, edi
add eax, 0x26
lea ecx, [eax + eax*8]
shl ecx, 3
sub ecx, eax
mov eax, 0x749cb29
shl ecx, 2
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
sub edx, esi
lea ecx, [edx + edi - 8]
mov eax, dword [ebx + 0x5a8]
mov dword [esp + 0x3c], ecx
test eax, eax
jne 0x422251
mov ecx, ebp
call fcn.00422de0
test eax, eax
je 0x422251
mov al, byte [ebp + 0x21]
test al, al
jne 0x4221fe
mov eax, dword [ebx + 0x47c]
test eax, eax
jne 0x4221fe
movsx edx, byte [ebx + 0x28]
add edx, 0x78
lea ecx, [ebp + 0x80]
push edx
call fcn.00448460
jmp 0x42221f
mov eax, dword [0x46af64]
mov ecx, dword [0x46af54]
add eax, 0x7b
add ecx, 0x55
push eax
lea edx, [ebp + 0x70d0]
push ecx
push edx
mov ecx, ebp
call fcn.00421640
movsx eax, byte [0x46ac10]
cmp dword [0x472248], eax
jne 0x42223f
push 3
push eax
mov ecx, 0x46a8a8
call fcn.0043b3c0
test eax, eax
jne 0x422251
movsx eax, byte [0x46ac10]
push eax
mov ecx, 0x46a8a8
call fcn.0043b450
movsx edx, byte [0x46ac10]
mov eax, dword [0x46af64]
add edx, 4
push edx
mov edx, dword [0x46af54]
push 0
push 0xa5
push 0x78
push eax
lea ecx, [ebp + 0x28]
push edx
call fcn.00447750
lea ecx, [esp + 0x48]
call sub.MFC42.DLL_CString::CString_2
push 0x46a404
lea ecx, [esp + 0x48]
mov dword [esp + 0xfc], 0
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x38]
mov byte [esp + 0xf8], 1
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebx + 6]
mov byte [esp + 0xf8], 2
push eax
lea eax, [esp + 0x4c]
push 0x466078
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x54]
add esp, 0xc
mov eax, dword [ecx - 8]
lea edx, [eax + 3]
cmp edx, 0xe
jle 0x4222e4
mov dword [esp + 0x10], 0xe
jmp 0x4222eb
add eax, 3
mov dword [esp + 0x10], eax
mov ecx, dword [ebx + 0x34]
lea eax, [esp + 0x38]
push eax
push ecx
push 0x46ac54
call fcn.0044ef84
movsx edx, byte [0x46ac10]
add esp, 0xc
and edx, 0x80000001
jns 0x422315
dec edx
or edx, 0xfffffffe
inc edx
je 0x422324
mov eax, dword [0x46ac00]
mov ecx, dword [0x46abfc]
jmp 0x42232f
mov eax, dword [0x46abfc]
mov ecx, dword [0x46ac00]
push ecx
push eax
lea eax, [esp + 0x4c]
push 0x46744c
push eax
mov dword [esp + 0x40], ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov ecx, ebp
call fcn.00422de0
test eax, eax
jne 0x422359
mov ecx, ebp
call fcn.00422e20
mov ecx, ebp
call fcn.00424070
test eax, eax
je 0x422377
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
sub ecx, edx
sub ecx, 0x26
mov dword [esp + 0x18], ecx
jmp 0x422388
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
sub edx, ecx
sub edx, 0x1c
mov dword [esp + 0x18], edx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x60]
push 0x466070
rep stosd dword es:[edi], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x64], 0xfffffff4
push eax
mov dword [esp + 0x78], 0x190
mov byte [esp + 0x7f], 0x86
mov byte [esp + 0x83], 2
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea ecx, [esp + 0xa8]
lea ebx, [ebp + 0x70d0]
mov dword [esp + 0x9c], 0xffffff
push ecx
mov ecx, ebx
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 1
call dword [sym.imp.2DEngineDll.dll_public:_struct_IXHandler::_mimage::_log_font___thiscall_IXHandler::_mimage::get_logfont_void_]
mov ecx, 0x12
mov esi, eax
lea edi, [esp + 0x60]
lea edx, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xa8]
push edx
push eax
mov ecx, ebx
mov dword [esp + 0xa4], 0xffffff
call dword [sym.imp.2DEngineDll.dll_public:_struct_IXHandler::_mimage::_log_font___thiscall_IXHandler::_mimage::set_logfont_struct_IXHandler::_mimage::_log_font_const__]
mov esi, eax
mov eax, dword [0x47a490]
mov ecx, 0x12
lea edi, [esp + 0x60]
test eax, eax
rep movsd dword es:[edi], dword [esi]
jne 0x42244f
mov eax, dword [0x46a9c4]
test eax, eax
jne 0x4224dc
mov ecx, dword [esp + 0x44]
mov esi, dword [ecx - 8]
mov ecx, ebp
call fcn.00422e20
mov edi, dword [esp + 0x10]
push 0xffe26c
push 1
push edi
lea ecx, [esi + edi]
mov esi, dword [esp + 0x2c]
lea edx, [ecx + ecx*2]
mov ecx, dword [esp + 0x34]
shl edx, 1
sub ecx, edx
sub ecx, esi
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x28]
cdq
sub eax, edx
mov edx, dword [ecx + 0x20]
mov esi, eax
lea eax, [ecx + 6]
push eax
mov eax, dword [esp + 0x28]
sar esi, 1
push edx
push eax
push esi
mov ecx, ebp
call fcn.00421490
mov ecx, dword [esp + 0x44]
lea eax, [edi + edi*2]
shl eax, 1
mov dword [esp + 0x10], 0
mov edx, dword [ecx - 8]
add eax, esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x34]
push edx
push eax
push ecx
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, ebx
call dword [sym.imp.2DEngineDll.dll_public:_void___thiscall_IXHandler::_mimage::text_int_const___int_const___char_const___int_const___int_const__]
mov eax, dword [esp + 0x1c]
test byte [eax + 0x470], 1
je 0x4225d5
mov ecx, ebp
call fcn.00422de0
lea edi, [ebp + 0x80]
push 0x90
mov ecx, edi
test eax, eax
call fcn.00448460
mov esi, eax
test esi, esi
je 0x4225d5
mov eax, dword [0x46a9c4]
test eax, eax
jle 0x42254b
push 0xac
mov ecx, edi
call fcn.00448460
mov ecx, dword [0x46af64]
mov edx, dword [0x46af54]
push 0
push 0
push 0
push 0
push 0
add ecx, 0x69
push eax
add edx, 0x46
push ecx
push edx
jmp 0x4225cb
mov ecx, ebp
call fcn.00424070
test eax, eax
mov eax, dword [esi + 0x10]
je 0x422591
cdq
mov ecx, dword [esi + 0xc]
sub eax, edx
mov edx, dword [esp + 0x3c]
push 0
sar eax, 1
push 0
push 0
sub edx, eax
mov eax, dword [esp + 0x34]
push 0
push 0
add edx, 0x30
push esi
push edx
mov edx, dword [esp + 0x3c]
sub eax, ecx
sub eax, edx
sub eax, 0x10a
cdq
sub eax, edx
sar eax, 1
add eax, 8
jmp 0x4225ca
mov ecx, dword [esp + 0x3c]
mov edi, dword [esi + 0xc]
cdq
sub eax, edx
push 0
sar eax, 1
push 0
push 0
sub ecx, eax
push 0
push 0
add ecx, 0x30
push esi
push ecx
mov ecx, ebp
call fcn.00422e20
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
sub edx, edi
sub edx, ecx
sub edx, eax
mov eax, edx
cdq
sub eax, edx
sar eax, 1
push eax
push 0
mov ecx, ebx
call dword [sym.imp.2DEngineDll.dll_public:_void___thiscall_IXHandler::_mimage::bitblt_int__int__int__class_IXHandler::_mimage___int__enum_IXHandler::_mimage::Align_Style__bool__struct_tagRECT___struct_IXHandler::_mimage::_mimage_blt_fx_const__]
mov eax, dword [0x46a9c4]
test eax, eax
je 0x422697
lea eax, [esp + 0x38]
lea ecx, [esp + 0x10]
push eax
push 0x467444
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xfc], 3
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
mov byte [esp + 0xf8], 2
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
push 0xffe26c
push 0
push 0x14
mov edx, dword [ecx + 0x20]
lea eax, [ecx + 6]
mov ecx, dword [0x46af54]
push eax
mov eax, dword [0x46af64]
push edx
add eax, 0xa8
add ecx, 6
push eax
push ecx
mov ecx, ebp
call fcn.00421490
mov eax, dword [esp + 0x38]
mov edx, dword [0x46af64]
mov dword [esp + 0x10], 0
add edx, 0xb7
mov ecx, dword [eax - 8]
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ecx
mov ecx, dword [0x46af54]
add ecx, 6
lea edx, [esp + 0x10]
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x34]
push edx
push ecx
push eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x4c]
push edx
push eax
mov ecx, ebx
call dword [sym.imp.2DEngineDll.dll_public:_void___thiscall_IXHandler::_mimage::text_int_const___int_const___char_const___int_const___int_const__]
mov esi, dword [sym.imp.2DEngineDll.dll_public:_struct_IXHandler::_mimage::_log_font___thiscall_IXHandler::_mimage::set_logfont_struct_IXHandler::_mimage::_log_font_const__]
lea ecx, [esp + 0x60]
lea edx, [esp + 0xa8]
push ecx
push edx
mov ecx, ebx
call esi
mov ecx, dword [esp + 0x30]
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x60]
setle al
dec eax
lea edx, [esp + 0xa8]
and eax, 0xff000100
push ecx
add eax, 0xffffff
push edx
mov ecx, ebx
mov dword [esp + 0xa4], eax
call esi
mov ecx, 0x12
mov esi, eax
lea edi, [esp + 0x60]
lea eax, [esp + 0x60]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xa8]
push eax
push ecx
mov ecx, ebx
call dword [sym.imp.2DEngineDll.dll_public:_struct_IXHandler::_mimage::_log_font___thiscall_IXHandler::_mimage::set_logfont_struct_IXHandler::_mimage::_log_font_const__]
lea edx, [esp + 0x4c]
mov ecx, 0x46a8a8
push edx
mov dword [esp + 0x18], 0
call fcn.004369c0
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx + 0x1b8]
test al, al
jle 0x422b72
mov ecx, ebp
call fcn.00422df0
mov ecx, ebp
mov esi, eax
call fcn.0041d5b0
neg al
sbb eax, eax
mov ecx, ebp
and eax, 3
add eax, 0xf
mov edi, eax
mov dword [esp + 0x30], edi
call fcn.0041d5b0
mov eax, dword [0x46ac14]
test eax, eax
jne 0x4228cc
mov eax, dword [0x47a490]
test eax, eax
je 0x4228cc
mov al, byte [0x46abd5]
test al, al
jne 0x4228cc
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0x1b8], 2
jle 0x4228cc
add eax, 0x78
mov ecx, 0x46a8a8
push eax
call fcn.004382c0
test al, al
jne 0x4228cc
mov ecx, dword [esi + 0xc]
mov eax, edi
shl eax, 4
add eax, ecx
mov ecx, ebp
mov dword [esp + 0x10], eax
call fcn.00424070
test eax, eax
mov eax, dword [esp + 0x54]
je 0x4227e4
sub eax, dword [esp + 0x4c]
sub eax, 0x10a
cdq
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
add edi, 8
jmp 0x4227fa
sub eax, dword [esp + 0x4c]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x10]
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
mov ecx, ebp
mov dword [esp + 0x14], edi
call fcn.00424070
test eax, eax
jne 0x422837
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
sub ecx, eax
mov eax, 0x51eb851f
shl ecx, 3
imul ecx
mov ecx, dword [0x46af54]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + ecx + 0x78]
cmp edi, eax
jge 0x42286d
jmp 0x422867
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
sub edx, ecx
mov eax, 0x567587c5
lea ecx, [edx*8 - 0x850]
imul ecx
mov ecx, dword [0x46af54]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + ecx + 0x78]
cmp edi, eax
jge 0x42286d
mov edi, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x11
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esi + 0x10]
sub edx, ecx
sub edx, eax
mov ecx, ebp
sub edx, 0x30
mov dword [esp + 0x18], edx
call fcn.00424070
test eax, eax
jne 0x42289b
add dword [esp + 0x18], 0xe
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 0
push 0
push esi
push eax
push edi
push 0
mov ecx, ebx
call dword [sym.imp.2DEngineDll.dll_public:_void___thiscall_IXHandler::_mimage::bitblt_int__int__int__class_IXHandler::_mimage___int__enum_IXHandler::_mimage::Align_Style__bool__struct_tagRECT___struct_IXHandler::_mimage::_mimage_blt_fx_const__]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
add edi, ecx
dec eax
mov dword [esp + 0x10], eax
jne 0x422875
jmp 0x422b72
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
movsx edi, byte [ecx + 0x1b8]
dec edi
mov ecx, ebp
imul edi, dword [esp + 0x30]
add edi, eax
call fcn.0041d5b0
mov ecx, ebp
call fcn.0041d5b0
mov ecx, ebp
call fcn.0041d5b0
neg al
sbb eax, eax
mov ecx, ebp
and eax, 3
add eax, 0xf
mov dword [esp + 0x5c], eax
call fcn.00424070
test eax, eax
mov eax, dword [esp + 0x54]
je 0x422932
sub eax, dword [esp + 0x4c]
sub eax, 0x10a
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
add ecx, 8
jmp 0x422946
sub eax, dword [esp + 0x4c]
cdq
sub eax, edx
mov ecx, eax
mov eax, edi
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
mov dword [esp + 0x14], ecx
mov ecx, ebp
call fcn.00424070
test eax, eax
jne 0x422987
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
sub ecx, edx
mov eax, 0x51eb851f
shl ecx, 3
imul ecx
mov ecx, dword [0x46af54]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + ecx + 0x78]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jge 0x4229bf
jmp 0x4229bb
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
sub edx, eax
mov eax, 0x567587c5
lea ecx, [edx*8 - 0x850]
imul ecx
mov ecx, dword [0x46af54]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [edx + ecx + 0x78]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
jge 0x4229bf
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], 0
mov al, byte [edx + 0x1b8]
test al, al
jle 0x422b72
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dword [esp + 0x10], eax
lea edi, [ecx + 0x78]
mov ecx, ebp
call fcn.00422de0
test eax, eax
je 0x4229fb
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], edx
jmp 0x422a1b
mov ecx, ebp
call fcn.0041d5b0
neg al
sbb eax, eax
mov ecx, dword [esp + 0x14]
and eax, 3
add eax, 0xb
imul eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x34], eax
mov ecx, ebp
call fcn.00424070
test eax, eax
mov eax, dword [esi + 0x10]
jne 0x422a75
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
sub eax, edx
add eax, 0x26
lea eax, [eax + eax*2]
lea ecx, [eax + eax*4]
mov eax, 0x749cb29
shl ecx, 1
imul ecx
mov eax, dword [edi + 4]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [esp + 0x24]
neg eax
sbb eax, eax
and eax, 0x19
sub edx, eax
mov eax, dword [esp + 0x40]
sub edx, ecx
mov ecx, dword [esp + 0x2c]
sub edx, eax
lea edx, [edx + ecx - 8]
jmp 0x422abe
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x24]
sub eax, ecx
lea ecx, [eax + eax*2]
shl ecx, 3
sub ecx, eax
mov eax, 0xb19ab5c5
shl ecx, 1
imul ecx
mov eax, dword [edi + 4]
add edx, ecx
sar edx, 9
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [esp + 0x40]
neg eax
sbb eax, eax
and eax, 0x19
sub edx, eax
mov eax, dword [esp + 0x24]
sub edx, eax
mov eax, dword [esp + 0x2c]
sub edx, ecx
add edx, eax
push edi
mov ecx, 0x46a8a8
mov dword [esp + 0x1c], edx
call fcn.004382c0
test al, al
jne 0x422aec
movsx ecx, byte [0x46ac10]
cmp ecx, dword [0x472248]
je 0x422aec
push 0
push 0
push 0
push 0
push 0
jmp 0x422b03
push 0
push 0
push 0
push 0
push edi
mov ecx, 0x46a8a8
call fcn.004382c0
movsx ecx, al
push ecx
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
push esi
push edx
push eax
push 0
mov ecx, ebx
call dword [sym.imp.2DEngineDll.dll_public:_void___thiscall_IXHandler::_mimage::bitblt_int__int__int__class_IXHandler::_mimage___int__enum_IXHandler::_mimage::Align_Style__bool__struct_tagRECT___struct_IXHandler::_mimage::_mimage_blt_fx_const__]
mov eax, dword [0x46ac14]
test eax, eax
je 0x422b45
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
add edx, 0x32
push edx
push 0
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x44]
push eax
push ecx
lea ecx, [ebp + 0x28]
call fcn.00447750
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
add ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1c]
inc eax
add edi, 8
movsx edx, byte [ecx + 0x1b8]
cmp eax, edx
mov dword [esp + 0x30], eax
jl 0x4229e6
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x422b85
mov eax, dword [esp + 0x1c]
lea edi, [eax + 0x31c]
jmp 0x422b8f
mov ecx, dword [esp + 0x1c]
lea edi, [ecx + 0x1c8]
mov ecx, ebp
call fcn.00422df0
mov ecx, ebp
mov esi, eax
call fcn.00424070
mov esi, dword [esi + 0x10]
test eax, eax
je 0x422bb8
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
lea edx, [esi + esi + 0x46]
sub eax, edx
sub eax, ecx
jmp 0x422bcc
mov edx, dword [esp + 0x24]
lea eax, [esi + esi]
mov ecx, eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
sub eax, edx
sub eax, 0x37
push edi
push eax
mov ecx, ebp
call fcn.00422e20
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
sub edx, esi
mov ecx, ebp
sub edx, eax
mov eax, edx
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.004236e0
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x470], 0x10
jne 0x422cd3
mov ecx, ebp
call fcn.00424070
test eax, eax
je 0x422c71
lea edi, [ebp + 0x80]
push 0xb3
mov ecx, edi
call fcn.00448460
test eax, eax
je 0x422c71
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push 0
push 0xb3
push 0xb3
mov ecx, edi
sub esi, edx
call fcn.00448bc0
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x44]
sar ecx, 1
sub eax, ecx
mov ecx, edi
add eax, 0x30
push eax
push 0xb3
call fcn.00448ba0
mov edx, eax
mov eax, esi
sub eax, edx
sub eax, 0x10a
cdq
sub eax, edx
sar eax, 1
add eax, 8
jmp 0x422cca
lea edi, [ebp + 0x80]
push 0xb3
mov ecx, edi
call fcn.00448460
test eax, eax
je 0x422cd3
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push 0
push 0xb3
push 0xb3
mov ecx, edi
sub esi, edx
call fcn.00448bc0
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x44]
sar ecx, 1
sub eax, ecx
mov ecx, edi
add eax, 0x30
push eax
push 0xb3
call fcn.00448ba0
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
push eax
push ebx
mov ecx, edi
call fcn.00448e00
mov eax, dword [0x47a490]
test eax, eax
je 0x422d2a
movsx edx, byte [0x46ac10]
cmp dword [0x47224c], edx
jne 0x422d2a
mov ecx, ebp
call fcn.00422de0
test eax, eax
je 0x422d0d
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
sub eax, esi
sub eax, 0xb9
push eax
push 0xdc
jmp 0x422d23
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
sub ecx, edi
sub ecx, 0x64
add edx, 0xffffffd8
push ecx
push edx
mov ecx, ebp
call fcn.00424b50
mov eax, dword [0x472248]
cmp eax, 0xffffffff
je 0x422d82
movsx ecx, byte [0x46ac10]
cmp eax, ecx
jne 0x422d82
mov ecx, ebp
call fcn.00422de0
test eax, eax
push 0
push 0x97
je 0x422d66
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
sub edx, eax
sub edx, 0x2b
push edx
push 0xd7
jmp 0x422d76
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x2c]
sub eax, edi
sub eax, 0x2b
push eax
push 0x50
push ebx
lea ecx, [ebp + 0x80]
call fcn.00448e00
lea ecx, [esp + 0x38]
mov byte [esp + 0xf8], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0xf8], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x48]
mov dword [esp + 0xf8], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov ecx, dword [esp + 0xe8]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xec
ret