Function at 0x408819
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460e02
mov eax, dword fs:[0]
push eax
sub esp, 0x78
push ebx
push esi
push edi
mov eax, dword [0x481028]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], 0xff00ff
mov dword [esp + 0x60], ebx
mov dword [esp + 0x50], vtable.CBkBitmap.0
mov byte [esp + 0x90], 1
mov eax, dword [0x4833bc]
mov ecx, 0x4833bc
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov edi, dword [ebp + 0xc]
mov byte [esp + 0x90], 2
push dword [edi + 0x24]
add esi, 4
push esi
lea eax, [esp + 0x38]
mov dword [esp + 0x24], esi
call fcn.00412b7a
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x58]
push ecx
call fcn.00412ac3
push dword [edi + 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push dword [esp + 0x38]
mov dword [esp + 0x1c], eax
push dword [esp + 0x38]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push 1
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [esp + 0x60]
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x24]
and al, 1
dec al
neg al
sbb eax, eax
and eax, 0xf1010
add eax, 0xf0efef
push eax
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_SetBkColor]
cmp eax, 0xffffffff
je 0x40895e
push eax
lea eax, [esp + 0x34]
push eax
lea esi, [esp + 0x1c]
call fcn.00411090
mov esi, dword [esp + 0x1c]
push ebx
call fcn.00412dc9
pop ecx
push eax
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push ebx
push 0x101f
push dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], ebx
call esi
push ebx
push ebx
push 0x1200
push eax
call esi
test eax, eax
jle 0x408a65
push dword [edi + 0x24]
mov ecx, dword [esp + 0x1c]
push dword [esp + 0x20]
lea eax, [esp + 0x48]
call fcn.00412aa1
push dword [esp + 0x18]
lea eax, [esp + 0x28]
push dword [edi + 0x24]
mov dword [esp + 0x28], 0x8024
push dword [esp + 0x24]
call fcn.00412a13
push 7
pop ecx
xor eax, eax
mov dword [esp + 0x64], 1
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x1c]
push 0x105f
push dword [edi]
call esi
test byte [esp + 0x68], 2
je 0x408a05
mov dword [esp + 0x20], 0x8025
jmp 0x408a14
test byte [esp + 0x68], 1
je 0x408a14
mov dword [esp + 0x20], 0x8026
cmp dword [esp + 0x18], ebx
je 0x408a24
add dword [esp + 0x40], 0xe
add dword [esp + 0x48], 0xe
push dword [esp + 0x20]
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
push dword [eax - 0xc]
push eax
push dword [esp + 0x24]
call dword [sym.imp.USER32.dll_DrawTextW]
inc dword [esp + 0x18]
push ebx
push ebx
push 0x101f
push dword [edi]
call esi
push ebx
push ebx
push 0x1200
push eax
call esi
cmp dword [esp + 0x18], eax
mov edi, dword [ebp + 0xc]
jl 0x40899b
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x18]
call esi
push dword [esp + 0x2c]
push dword [esp + 0x18]
call esi
push 0xffffffffffffffff
push dword [esp + 0x38]
lea ecx, [esp + 0x58]
push dword [esp + 0x38]
push dword [edi + 0x10]
call fcn.004124b7
lea ecx, [esp + 0x50]
call fcn.0041249f
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.00404929
cmp dword [esp + 0x14], ebx
je 0x408aba
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteDC]
push 4
pop eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8