Function at 0x491c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f48f8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_SetRect]
mov ebx, ecx
mov eax, dword [ebx + 0x34]
sub eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
sub ecx, dword [ebx + 0x28]
push eax
push ecx
push 0
push 0
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x54], esi
call edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
add eax, 0xfffffff6
push eax
mov eax, dword [esp + 0x24]
add ecx, 0xfffffff6
push ecx
add edx, 5
push edx
add eax, 5
push eax
lea ecx, [esp + 0x40]
push ecx
call edi
push 0xdd
push 0xdd
push 0xdd
push 0xfe
push esi
lea edi, [esp + 0x44]
call fcn.00403470
mov eax, dword [ebx + 0x104]
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
push eax
add edx, 0xc
push 0
push 0x50d86c
mov dword [esp + 0x1c], edx
add edi, 0xa
call fcn.00410770
mov ecx, dword [esp + 0x30]
add esp, 0xc
lea edx, [edx + ecx + 0xd]
push edx
lea eax, [eax + edi + 0xa]
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
call fcn.0040a730
mov edi, dword [eax + 4]
push 0x8024
call fcn.0040a730
call fcn.0040ac90
push eax
lea edx, [esp + 0x34]
push edx
push 0x50d86c
push esi
mov ecx, 0x5a5a5a
mov edx, edi
call fcn.004036c0
cmp dword [ebx + 0xac], 8
jb 0x491d4f
mov eax, dword [ebx + 0x98]
jmp 0x491d55
lea eax, [ebx + 0x98]
mov ecx, dword [ebx + 0x104]
push ecx
push 0
push eax
call fcn.00410770
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
lea edi, [edx + eax]
mov edx, dword [esp + 0x34]
add esp, 0xc
push edi
add edx, 0xfffffff6
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_SetRect]
call fcn.0040a730
cmp dword [ebx + 0xac], 8
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
jb 0x491db1
mov eax, dword [ebx + 0x98]
mov dword [esp + 0x10], eax
jmp 0x491dbb
lea ecx, [ebx + 0x98]
mov dword [esp + 0x10], ecx
push 0x8004
call fcn.0040a730
call fcn.0040ac90
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
push eax
push esi
mov ecx, 0x5a5a5a
call fcn.004036c0
cmp dword [ebx + 0xc8], 8
jb 0x491df5
mov eax, dword [ebx + 0xb4]
jmp 0x491dfb
lea eax, [ebx + 0xb4]
mov ecx, dword [ebx + 0x104]
push ecx
push 0
push eax
call fcn.00410770
mov ecx, dword [esp + 0x34]
add esp, 0xc
add edi, edx
push edi
lea edx, [ecx - 0xa]
push edx
mov edx, dword [esp + 0x20]
sub ecx, eax
push edx
sub ecx, 0x14
push ecx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_SetRect]
call fcn.0040a730
cmp dword [ebx + 0xc8], 8
mov ecx, dword [eax + 4]
mov dword [esp + 0x18], ecx
jb 0x491e4f
mov edx, dword [ebx + 0xb4]
mov dword [esp + 0x10], edx
jmp 0x491e59
lea eax, [ebx + 0xb4]
mov dword [esp + 0x10], eax
push 0x8024
call fcn.0040a730
call fcn.0040ac90
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
push edx
mov edx, dword [esp + 0x24]
push esi
mov ecx, 0x5a5a5a
call fcn.004036c0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
push 0xdd
push 0xdd
push 0xdd
push 0xfe
push edi
add eax, 0xfffffff0
push eax
push edi
add ecx, 8
push ecx
push esi
call fcn.004039e0
mov eax, dword [ebx + 0x104]
mov edx, dword [esp + 0x20]
push eax
add edx, 0xa
push 0
push 0x50d874
add edi, 5
mov dword [esp + 0x24], edx
call fcn.00410770
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea eax, [eax + ecx + 0xa]
add edx, edi
push edx
push eax
push edi
push ecx
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_SetRect]
call fcn.0040a730
mov edx, dword [eax + 4]
push 0x8024
mov dword [esp + 0x1c], edx
call fcn.0040a730
call fcn.0040ac90
mov edx, dword [esp + 0x18]
push eax
lea eax, [esp + 0x34]
push eax
push 0x50d874
push esi
mov ecx, 0x5a5a5a
call fcn.004036c0
push 0xb
xor ecx, ecx
push 0x50d87c
lea esi, [esp + 0x4c]
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], 0
mov word [esp + 0x50], cx
call fcn.00401760
mov dword [esp + 0x70], 0
cmp dword [ebx + 0xe0], 0
jbe 0x491f6e
push 0xffffffffffffffff
push 0
lea edx, [ebx + 0xcc]
push edx
mov eax, esi
call fcn.00401850
mov eax, dword [esp + 0x48]
mov esi, 8
cmp dword [esp + 0x5c], esi
jae 0x491f81
lea eax, [esp + 0x48]
mov ecx, dword [ebx + 0x104]
push ecx
push 0
push eax
call fcn.00410770
add esp, 0xc
add edx, edi
push edx
mov edx, dword [esp + 0x2c]
add edx, 0xfffffff6
push edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
push edi
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
call fcn.0040a730
mov edi, dword [eax + 4]
mov ebx, dword [esp + 0x48]
cmp dword [esp + 0x5c], esi
jae 0x491fc9
lea ebx, [esp + 0x48]
push 0x8004
call fcn.0040a730
call fcn.0040ac90
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x34]
push edx
push ebx
push eax
mov ecx, 0x5a5a5a
mov edx, edi
call fcn.004036c0
cmp dword [esp + 0x5c], esi
jb 0x492003
mov ecx, dword [esp + 0x48]
push ecx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004c8f08
mov esp, ebp
pop ebp
ret 4