Function at 0x47be20
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ef8e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x33c
push esi
push edi
xor edi, edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 4], 1
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
test edx, edx
je 0x47bea2
test edx, 0xffff0000
jne 0x47be92
movzx eax, dx
lea ecx, [ebp - 0x24]
push eax
call fcn.004062a0
jmp 0x47beae
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47be97
sub ecx, esi
jmp 0x47bea4
xor ecx, ecx
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.00401820
push 1
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x40]
call fcn.004baa70
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47bedf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.presentation
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x40]
call fcn.004bb2b0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.004ba5e0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x47bf10
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x47bf21
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 0x14], ecx
push str.__newslide
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x40]
call fcn.004baec0
mov byte [ebp - 4], 0xc
mov esi, dword [eax]
mov dword [ebp - 0x84], 0
test esi, esi
je 0x47bf85
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
push esi
mov dword [ebp - 0x3c], 0
call dword [eax + 0x20]
test eax, eax
jns 0x47bf7c
push 0x50f9d8
push esi
push eax
call fcn.004e2c00
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x84], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0xe4]
test ecx, ecx
je 0x47bf99
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0xe8]
test ecx, ecx
je 0x47bfad
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb
xor ecx, ecx
mov dword [ebp - 0x80], 0
mov esi, dword [ebp - 0x7c]
xor eax, eax
mov dword [ebp - 0x3c], ecx
test esi, esi
je 0x47bfec
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x20]
test eax, eax
jns 0x47bfe3
push 0x50f9d8
push esi
push eax
call fcn.004e2c00
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x3c]
cmp ecx, eax
jge 0x47e707
push ecx
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x7c]
call fcn.004ba8e0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov esi, dword [eax]
cmp ecx, esi
je 0x47c032
mov byte [ebp - 4], 0xf
test esi, esi
je 0x47c021
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 0x10
test ecx, ecx
je 0x47c032
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov esi, dword [esi + 4]
cmp ecx, esi
je 0x47c061
mov byte [ebp - 4], 0x11
test esi, esi
je 0x47c050
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x12
test ecx, ecx
je 0x47c061
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0xec]
test ecx, ecx
je 0x47c075
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xf0]
test ecx, ecx
je 0x47c089
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba170
push str.newslide
push dword [eax]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0x90]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47c0d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x47d2e9
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x18]
push str.layout
call fcn.004b8fd0
push eax
lea ecx, [esi + 0x34]
call fcn.00468b70
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x10]
inc eax
mov dword [ebp - 0x80], eax
test ecx, ecx
je 0x47c10d
push dword [ebp - 0x84]
push eax
push ecx
call dword [ebp + 0xc]
add esp, 0xc
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
push str.backgroundimage
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x17
cmp dword [eax], 0
je 0x47c182
push str.backgroundimage
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x18
push ecx
or edi, 1
mov ecx, eax
mov dword [ebp - 0x10], edi
call fcn.004b9e30
mov dword [ebp - 4], 0x19
or edi, 2
jmp 0x47c1d8
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x44], eax
mov eax, 0x4fd088
mov dword [ebp - 4], 0x1a
lea ecx, [ebp - 0x44]
test eax, 0xffff0000
jne 0x47c1bf
movzx eax, ax
push eax
call fcn.004062a0
jmp 0x47c1cb
push 0
push 0x4fd088
call fcn.00401820
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0x1b
or edi, 4
mov edx, dword [eax]
mov dword [ebp - 0x10], edi
lea edi, [esi - 0x10]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x47c22c
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x47c21d
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x47c21d
call fcn.00401750
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x47c215
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x20]
lea esi, [eax + 0x10]
mov dword [ebp + 8], esi
jmp 0x47c22c
push dword [edx - 0xc]
lea ecx, [ebp + 8]
push edx
call fcn.00401820
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0x19
mov ecx, dword [ebp - 0x10]
test cl, 4
je 0x47c25f
mov edx, dword [ebp - 0x44]
and ecx, 0xfffffffb
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c25f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x18
test cl, 2
je 0x47c292
mov edx, dword [ebp - 0x94]
and ecx, 0xfffffffd
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c292
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x17
test cl, 1
je 0x47c2cc
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0xf4]
test ecx, ecx
je 0x47c2b8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0xf8]
test ecx, ecx
je 0x47c2cc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0xfc]
test ecx, ecx
je 0x47c2e0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x100]
test ecx, ecx
je 0x47c2f4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x16
cmp dword [esi - 0xc], 0
jle 0x47c30d
mov ecx, dword [ebp - 0x30]
lea eax, [ebp + 8]
push eax
lea ecx, [ecx + 0x34]
call fcn.00469b90
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x74], eax
push str.subtitle2
lea eax, [ebp - 0x130]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x21
cmp dword [eax], 0
je 0x47c39a
push str.subtitle2
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xa0]
mov esi, dword [ebp - 0x10]
push ecx
or esi, 8
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9e30
mov dword [ebp - 4], 0x23
mov ecx, 0x4fd088
mov edi, dword [eax]
or esi, 0x10
mov eax, ecx
shr eax, 0x10
mov dword [ebp - 0x20], eax
movzx eax, cx
mov dword [ebp - 0x24], eax
jmp 0x47c401
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x50], eax
mov eax, 0x4fd088
mov dword [ebp - 4], 0x24
mov ecx, 0x4fd088
shr eax, 0x10
movzx esi, cx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
test eax, eax
jne 0x47c3e2
push esi
call fcn.004062a0
jmp 0x47c3f1
push 0
push 0x4fd088
call fcn.00401820
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0x25
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x50]
or esi, 0x20
push str.subtitle
lea eax, [ebp - 0x120]
mov dword [ebp - 0x10], esi
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x26
cmp dword [eax], 0
je 0x47c464
push str.subtitle
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0x27
push ecx
or esi, 0x40
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9e30
or esi, 0x80
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x10], esi
mov esi, dword [eax]
jmp 0x47c4b9
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0x29
lea ecx, [ebp - 0x4c]
cmp dword [ebp - 0x20], 0
jne 0x47c49a
push dword [ebp - 0x24]
call fcn.004062a0
jmp 0x47c4a6
push 0
push 0x4fd088
call fcn.00401820
or esi, 0x100
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x4c]
push str.title
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x2b
cmp dword [eax], 0
je 0x47c518
push str.title
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0x2c
or dword [ebp - 0x10], 0x200
push ecx
mov ecx, eax
call fcn.004b9e30
mov dword [ebp - 4], 0x2d
or dword [ebp - 0x10], 0x400
mov eax, dword [eax]
jmp 0x47c56b
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0x2e
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x20], 0
jne 0x47c54e
push dword [ebp - 0x24]
call fcn.004062a0
jmp 0x47c55a
push 0
push 0x4fd088
call fcn.00401820
mov dword [ebp - 4], 0x2f
or dword [ebp - 0x10], 0x800
mov eax, dword [ebp - 0x48]
push edi
push esi
push eax
lea eax, [ebp - 0x74]
push str._s_r_n_s_r_n_s
push eax
call fcn.004063e0
mov dword [ebp - 4], 0x2d
add esp, 0x14
mov ecx, dword [ebp - 0x10]
test ecx, 0x800
je 0x47c5b8
mov edx, dword [ebp - 0x48]
and ecx, 0xfffff7ff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c5b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x2c
test ecx, 0x400
je 0x47c5f1
mov edx, dword [ebp - 0x98]
and ecx, 0xfffffbff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c5f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x2b
test ecx, 0x200
je 0x47c631
and ecx, 0xfffffdff
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x104]
test ecx, ecx
je 0x47c61d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x108]
test ecx, ecx
je 0x47c631
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x32
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x47c648
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x33
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x47c65f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x28
mov ecx, dword [ebp - 0x10]
test ecx, 0x100
je 0x47c698
mov edx, dword [ebp - 0x4c]
and ecx, 0xfffffeff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c698
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x27
test cl, cl
jns 0x47c6cd
mov edx, dword [ebp - 0x9c]
and ecx, 0xffffff7f
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c6cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x26
test cl, 0x40
je 0x47c707
and ecx, 0xffffffbf
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x114]
test ecx, ecx
je 0x47c6f3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x35
mov ecx, dword [ebp - 0x118]
test ecx, ecx
je 0x47c707
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x36
mov ecx, dword [ebp - 0x11c]
test ecx, ecx
je 0x47c71e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x37
mov ecx, dword [ebp - 0x120]
test ecx, ecx
je 0x47c735
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x23
mov ecx, dword [ebp - 0x10]
test cl, 0x20
je 0x47c768
mov edx, dword [ebp - 0x50]
and ecx, 0xffffffdf
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c768
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x22
test cl, 0x10
je 0x47c79b
mov edx, dword [ebp - 0xa0]
and ecx, 0xffffffef
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c79b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x21
test cl, 8
je 0x47c7d5
and ecx, 0xfffffff7
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x124]
test ecx, ecx
je 0x47c7c1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x128]
test ecx, ecx
je 0x47c7d5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x12c]
test ecx, ecx
je 0x47c7e9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x130]
test ecx, ecx
je 0x47c7fd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push str.fontbold
lea eax, [ebp - 0x1d8]
mov byte [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x3c
cmp dword [eax], 0
je 0x47c8cc
push str.fontbold
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x3d
xor ecx, ecx
mov esi, dword [ebp - 0x10]
mov edi, dword [eax]
or esi, 0x1000
mov dword [ebp - 0x10], esi
test edi, edi
je 0x47c8bf
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [edi]
lea ecx, [ebp - 0x2b8]
push ecx
push edi
call dword [eax + 0x78]
test eax, eax
jns 0x47c878
push 0x50f9f8
push edi
push eax
call fcn.004e2c00
movups xmm0, xmmword [ebp - 0x2b8]
or dword [ebp - 0x1c], 0x100
xor eax, eax
mov word [ebp - 0x2b8], ax
movups xmmword [ebp - 0x308], xmm0
lea ecx, [ebp - 0x308]
mov dword [ebp - 4], 0x3e
call fcn.004bc1d0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x308]
push eax
mov byte [ebp - 4], 0x3d
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
setne al
mov byte [ebp - 0x88], al
jmp 0x47c8d6
mov esi, dword [ebp - 0x10]
mov byte [ebp - 0x88], 0
push str.fontface
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x3f
cmp dword [eax], 0
je 0x47c937
push str.fontface
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0x40
push ecx
or esi, 0x2000
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9e30
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0x41
or esi, 0x4000
jmp 0x47c993
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x58], eax
mov eax, 0x508cdc
mov dword [ebp - 4], 0x42
lea ecx, [ebp - 0x58]
test eax, 0xffff0000
jne 0x47c974
movzx eax, ax
push eax
call fcn.004062a0
jmp 0x47c980
push 5
push 0x508cdc
call fcn.00401820
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 0x43
mov dword [ebp - 0x20], eax
or esi, 0x8000
push str.align
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x10], esi
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x44
cmp dword [eax], 0
je 0x47c9f7
push str.align
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x45
push ecx
or esi, 0x10000
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9e30
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0x46
or esi, 0x20000
jmp 0x47ca53
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x54], eax
mov eax, str.left
mov dword [ebp - 4], 0x47
lea ecx, [ebp - 0x54]
test eax, 0xffff0000
jne 0x47ca34
movzx eax, ax
push eax
call fcn.004062a0
jmp 0x47ca40
push 4
push str.left
call fcn.00401820
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0x48
mov dword [ebp - 0x24], eax
or esi, 0x40000
push str.subtitlefont
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x10], esi
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x49
cmp dword [eax], 0
je 0x47caa0
push str.subtitlefont
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 0x80000
mov byte [ebp - 4], 0x4a
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9c90
jmp 0x47caa8
movsd xmm0, qword [0x514500]
push str.titlefont
lea eax, [ebp - 0x198]
movsd qword [ebp - 0x138], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x4b
cmp dword [eax], 0
je 0x47cafa
push str.titlefont
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 0x100000
mov byte [ebp - 4], 0x4c
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9c90
jmp 0x47cb02
movsd xmm0, qword [0x514510]
push str.color
lea eax, [ebp - 0x188]
movsd qword [ebp - 0x68], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x4d
cmp dword [eax], 0
je 0x47cbc5
push str.color
lea eax, [ebp - 0x180]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x4e
or esi, 0x200000
mov edi, dword [eax]
mov dword [ebp - 0x10], esi
test edi, edi
je 0x47cbc1
lea eax, [ebp - 0x2c8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [edi]
lea ecx, [ebp - 0x2c8]
push ecx
push edi
call dword [eax + 0x78]
test eax, eax
jns 0x47cb7c
push 0x50f9f8
push edi
push eax
call fcn.004e2c00
movups xmm0, xmmword [ebp - 0x2c8]
or dword [ebp - 0x1c], 0x200
xor eax, eax
mov word [ebp - 0x2c8], ax
movups xmmword [ebp - 0x318], xmm0
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], 0x4f
call fcn.004bc1d0
mov edi, eax
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x47cbca
xor edi, edi
jmp 0x47cbca
mov edi, 0xff
push str.height
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x50
cmp dword [eax], 0
je 0x47cc14
push str.height
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 0x400000
mov byte [ebp - 4], 0x51
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9c90
jmp 0x47cc1c
movsd xmm0, qword [0x514520]
push str.width
lea eax, [ebp - 0x168]
movsd qword [ebp - 0x70], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x52
cmp dword [eax], 0
je 0x47cc6b
push str.width
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 0x800000
mov byte [ebp - 4], 0x53
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9c90
jmp 0x47cc73
movsd xmm0, qword [0x514570]
push str.left
lea eax, [ebp - 0x158]
movsd qword [ebp - 0x38], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x54
cmp dword [eax], 0
je 0x47ccc2
push str.left
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 0x1000000
mov byte [ebp - 4], 0x55
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9c90
jmp 0x47ccc5
xorps xmm0, xmm0
push 0x508f5c
lea eax, [ebp - 0x148]
movsd qword [ebp - 0x2c], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x56
cmp dword [eax], 0
je 0x47cd1f
push 0x508f5c
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 0x2000000
mov byte [ebp - 4], 0x57
mov ecx, eax
mov dword [ebp - 0x10], esi
call fcn.004b9c90
cvtsd2ss xmm0, xmm0
xorps xmm2, xmm2
cvtss2sd xmm2, xmm0
jmp 0x47cd22
xorps xmm2, xmm2
push dword [ebp - 0x88]
movsd xmm0, qword [ebp - 0x138]
lea eax, [ebp - 0x74]
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
push dword [ebp - 0x24]
cvtpd2ps xmm0, xmm0
sub esp, 8
lea ecx, [ecx + 0x34]
movsd xmm3, qword [ebp - 0x2c]
movss dword [esp + 4], xmm0
movsd xmm0, qword [ebp - 0x68]
cvtpd2ps xmm0, xmm0
movss dword [esp], xmm0
movsd xmm0, qword [ebp - 0x70]
push edi
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x38]
movsd qword [esp], xmm0
push eax
call fcn.00469180
mov dword [ebp - 4], 0x56
test esi, 0x2000000
je 0x47cdbe
and esi, 0xfdffffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x58
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
je 0x47cdaa
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x59
mov ecx, dword [ebp - 0x140]
test ecx, ecx
je 0x47cdbe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x5a
mov ecx, dword [ebp - 0x144]
test ecx, ecx
je 0x47cdd5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x5b
mov ecx, dword [ebp - 0x148]
test ecx, ecx
je 0x47cdec
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x54
test esi, 0x1000000
je 0x47ce2c
and esi, 0xfeffffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0x14c]
test ecx, ecx
je 0x47ce18
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x5d
mov ecx, dword [ebp - 0x150]
test ecx, ecx
je 0x47ce2c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x5e
mov ecx, dword [ebp - 0x154]
test ecx, ecx
je 0x47ce43
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x5f
mov ecx, dword [ebp - 0x158]
test ecx, ecx
je 0x47ce5a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x52
test esi, 0x800000
je 0x47ce9a
and esi, 0xff7fffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x60
mov ecx, dword [ebp - 0x15c]
test ecx, ecx
je 0x47ce86
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x61
mov ecx, dword [ebp - 0x160]
test ecx, ecx
je 0x47ce9a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x62
mov ecx, dword [ebp - 0x164]
test ecx, ecx
je 0x47ceb1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x63
mov ecx, dword [ebp - 0x168]
test ecx, ecx
je 0x47cec8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x50
test esi, 0x400000
je 0x47cf08
and esi, 0xffbfffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0x16c]
test ecx, ecx
je 0x47cef4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x65
mov ecx, dword [ebp - 0x170]
test ecx, ecx
je 0x47cf08
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x66
mov ecx, dword [ebp - 0x174]
test ecx, ecx
je 0x47cf1f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x67
mov ecx, dword [ebp - 0x178]
test ecx, ecx
je 0x47cf36
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x4d
test esi, 0x200000
je 0x47cf76
and esi, 0xffdfffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x68
mov ecx, dword [ebp - 0x17c]
test ecx, ecx
je 0x47cf62
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x69
mov ecx, dword [ebp - 0x180]
test ecx, ecx
je 0x47cf76
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x6a
mov ecx, dword [ebp - 0x184]
test ecx, ecx
je 0x47cf8d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x6b
mov ecx, dword [ebp - 0x188]
test ecx, ecx
je 0x47cfa4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x4b
test esi, 0x100000
je 0x47cfe4
and esi, 0xffefffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x6c
mov ecx, dword [ebp - 0x18c]
test ecx, ecx
je 0x47cfd0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x6d
mov ecx, dword [ebp - 0x190]
test ecx, ecx
je 0x47cfe4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x6e
mov ecx, dword [ebp - 0x194]
test ecx, ecx
je 0x47cffb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x6f
mov ecx, dword [ebp - 0x198]
test ecx, ecx
je 0x47d012
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x49
test esi, 0x80000
je 0x47d052
and esi, 0xfff7ffff
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0x70
mov ecx, dword [ebp - 0x19c]
test ecx, ecx
je 0x47d03e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x71
mov ecx, dword [ebp - 0x1a0]
test ecx, ecx
je 0x47d052
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x72
mov ecx, dword [ebp - 0x1a4]
test ecx, ecx
je 0x47d069
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x73
mov ecx, dword [ebp - 0x1a8]
test ecx, ecx
je 0x47d080
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x46
mov ecx, dword [ebp - 0x10]
test ecx, 0x40000
je 0x47d0b9
mov edx, dword [ebp - 0x54]
and ecx, 0xfffbffff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d0b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x45
test ecx, 0x20000
je 0x47d0f2
mov edx, dword [ebp - 0xa4]
and ecx, 0xfffdffff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d0f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x44
test ecx, 0x10000
je 0x47d132
and ecx, 0xfffeffff
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0x74
mov ecx, dword [ebp - 0x1ac]
test ecx, ecx
je 0x47d11e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x75
mov ecx, dword [ebp - 0x1b0]
test ecx, ecx
je 0x47d132
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x76
mov ecx, dword [ebp - 0x1b4]
test ecx, ecx
je 0x47d149
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x77
mov ecx, dword [ebp - 0x1b8]
test ecx, ecx
je 0x47d160
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x41
mov ecx, dword [ebp - 0x10]
test ecx, 0x8000
je 0x47d199
mov edx, dword [ebp - 0x58]
and ecx, 0xffff7fff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d199
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x40
test ecx, 0x4000
je 0x47d1d2
mov edx, dword [ebp - 0xa8]
and ecx, 0xffffbfff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d1d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x3f
test ecx, 0x2000
je 0x47d212
and ecx, 0xffffdfff
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0x78
mov ecx, dword [ebp - 0x1bc]
test ecx, ecx
je 0x47d1fe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x79
mov ecx, dword [ebp - 0x1c0]
test ecx, ecx
je 0x47d212
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x7a
mov ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x47d229
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x7b
mov ecx, dword [ebp - 0x1c8]
test ecx, ecx
je 0x47d240
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x3c
mov edi, dword [ebp - 0x10]
test edi, 0x1000
je 0x47d283
and edi, 0xffffefff
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0x7c
mov ecx, dword [ebp - 0x1cc]
test ecx, ecx
je 0x47d26f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x7d
mov ecx, dword [ebp - 0x1d0]
test ecx, ecx
je 0x47d283
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x7e
mov ecx, dword [ebp - 0x1d4]
test ecx, ecx
je 0x47d297
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x7f
mov ecx, dword [ebp - 0x1d8]
test ecx, ecx
je 0x47d2ab
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x16
or eax, 0xffffffff
mov edx, dword [ebp - 0x74]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d2ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d2e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba170
push str.footer
push dword [eax]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0xac]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47d32c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x47dd2a
push str.fontbold
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x81
cmp dword [eax], esi
je 0x47d3fb
push str.fontbold
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x82
or edi, 0x4000000
mov esi, dword [eax]
xor ecx, ecx
mov dword [ebp - 0x10], edi
test esi, esi
je 0x47d3ee
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi]
lea ecx, [ebp - 0x2d8]
push ecx
push esi
call dword [eax + 0x78]
test eax, eax
jns 0x47d3a7
push 0x50f9f8
push esi
push eax
call fcn.004e2c00
movups xmm0, xmmword [ebp - 0x2d8]
or dword [ebp - 0x1c], 0x400
xor eax, eax
mov word [ebp - 0x2d8], ax
movups xmmword [ebp - 0x328], xmm0
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], 0x83
call fcn.004bc1d0
mov dword [ebp + 8], eax
lea eax, [ebp - 0x328]
push eax
mov byte [ebp - 4], 0x82
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp + 8]
test ecx, ecx
setne al
mov byte [ebp - 0x8c], al
jmp 0x47d402
mov byte [ebp - 0x8c], 0
push str.fontface
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x84
cmp dword [eax], 0
je 0x47d463
push str.fontface
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x85
push ecx
or edi, 0x8000000
mov ecx, eax
mov dword [ebp - 0x10], edi
call fcn.004b9e30
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0x86
or edi, 0x10000000
jmp 0x47d4bf
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x60], eax
mov eax, 0x508cdc
mov dword [ebp - 4], 0x87
lea ecx, [ebp - 0x60]
test eax, 0xffff0000
jne 0x47d4a0
movzx eax, ax
push eax
call fcn.004062a0
jmp 0x47d4ac
push 5
push 0x508cdc
call fcn.00401820
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 0x88
mov dword [ebp - 0x24], eax
or edi, 0x20000000
push str.size
lea eax, [ebp - 0x248]
mov dword [ebp - 0x10], edi
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x89
cmp dword [eax], 0
je 0x47d584
push str.size
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x8a
or edi, 0x40000000
mov esi, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp + 8], 0
test esi, esi
je 0x47d58b
lea eax, [ebp - 0x2e8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi]
lea ecx, [ebp - 0x2e8]
push ecx
push esi
call dword [eax + 0x78]
test eax, eax
jns 0x47d53e
push 0x50f9f8
push esi
push eax
call fcn.004e2c00
movups xmm0, xmmword [ebp - 0x2e8]
or dword [ebp - 0x1c], 0x800
xor eax, eax
mov word [ebp - 0x2e8], ax
movups xmmword [ebp - 0x338], xmm0
lea ecx, [ebp - 0x338]
mov dword [ebp - 4], 0x8b
call fcn.004bc1d0
mov dword [ebp + 8], eax
lea eax, [ebp - 0x338]
push eax
mov byte [ebp - 4], 0x8a
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x47d58b
mov dword [ebp + 8], 0xa
push str.color
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x8c
cmp dword [eax], 0
je 0x47d64d
push str.color
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x8d
or edi, 0x80000000
mov esi, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], 0
test esi, esi
je 0x47d654
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi]
lea ecx, [ebp - 0x2f8]
push ecx
push esi
call dword [eax + 0x78]
test eax, eax
jns 0x47d607
push 0x50f9f8
push esi
push eax
call fcn.004e2c00
movups xmm0, xmmword [ebp - 0x2f8]
or dword [ebp - 0x1c], 0x1000
xor eax, eax
mov word [ebp - 0x2f8], ax
movups xmmword [ebp - 0x348], xmm0
lea ecx, [ebp - 0x348]
mov dword [ebp - 4], 0x8e
call fcn.004bc1d0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x348]
push eax
mov byte [ebp - 4], 0x8d
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x47d654
mov dword [ebp - 0x20], 0
push str.height
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x8f
cmp dword [eax], 0
je 0x47d69e
push str.height
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov byte [ebp - 4], 0x90
mov ecx, eax
mov esi, dword [ebp - 0x1c]
or esi, 1
mov dword [ebp - 0x1c], esi
call fcn.004b9c90
jmp 0x47d6a9
movsd xmm0, qword [0x514520]
mov esi, dword [ebp - 0x1c]
push str.width
lea eax, [ebp - 0x218]
movsd qword [ebp - 0x2c], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x91
cmp dword [eax], 0
je 0x47d6f5
push str.width
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 2
mov byte [ebp - 4], 0x92
mov ecx, eax
mov dword [ebp - 0x1c], esi
call fcn.004b9c90
jmp 0x47d6fd
movsd xmm0, qword [0x514570]
push str.left
lea eax, [ebp - 0x208]
movsd qword [ebp - 0x38], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x93
cmp dword [eax], 0
je 0x47d749
push str.left
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 4
mov byte [ebp - 4], 0x94
mov ecx, eax
mov dword [ebp - 0x1c], esi
call fcn.004b9c90
jmp 0x47d74c
xorps xmm0, xmm0
push 0x508f5c
lea eax, [ebp - 0x1f8]
movsd qword [ebp - 0x70], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x95
cmp dword [eax], 0
je 0x47d798
push 0x508f5c
lea eax, [ebp - 0x1f0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
or esi, 8
mov byte [ebp - 4], 0x96
mov ecx, eax
mov dword [ebp - 0x1c], esi
call fcn.004b9c90
jmp 0x47d79b
xorps xmm0, xmm0
push str.text
lea eax, [ebp - 0x1e8]
movsd qword [ebp - 0x68], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
mov dword [ebp - 4], 0x97
cmp dword [eax], 0
je 0x47d7f8
push str.text
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba6c0
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x98
push ecx
or esi, 0x10
mov ecx, eax
mov dword [ebp - 0x1c], esi
call fcn.004b9e30
mov dword [ebp - 4], 0x99
or esi, 0x20
jmp 0x47d84e
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov eax, 0x4fd088
mov dword [ebp - 4], 0x9a
lea ecx, [ebp - 0x5c]
test eax, 0xffff0000
jne 0x47d835
movzx eax, ax
push eax
call fcn.004062a0
jmp 0x47d841
push 0
push 0x4fd088
call fcn.00401820
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0x9b
or esi, 0x40
push dword [ebp - 0x8c]
movsd xmm0, qword [ebp - 0x2c]
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
push dword [ebp + 8]
movsd xmm3, qword [ebp - 0x70]
push dword [ebp - 0x20]
movsd xmm2, qword [ebp - 0x68]
lea ecx, [ecx + 0x34]
sub esp, 0x10
mov dword [ebp - 0x1c], esi
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x38]
movsd qword [esp], xmm0
push eax
call fcn.00469d20
mov ecx, esi
mov dword [ebp - 4], 0x99
test cl, 0x40
je 0x47d8c0
mov edx, dword [ebp - 0x5c]
and ecx, 0xffffffbf
mov dword [ebp - 0x1c], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d8c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0x98
test cl, 0x20
je 0x47d8f3
mov edx, dword [ebp - 0xb0]
and ecx, 0xffffffdf
mov dword [ebp - 0x1c], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47d8f3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0x97
test cl, 0x10
je 0x47d92d
and ecx, 0xffffffef
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 0x9c
mov ecx, dword [ebp - 0x1dc]
test ecx, ecx
je 0x47d919
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0x9d
mov ecx, dword [ebp - 0x1e0]
test ecx, ecx
je 0x47d92d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x9e
mov ecx, dword [ebp - 0x1e4]
test ecx, ecx
je 0x47d944
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x9f
mov ecx, dword [ebp - 0x1e8]
test ecx, ecx
je 0x47d95b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x95
mov eax, dword [ebp - 0x1c]
test al, 8
je 0x47d997
and eax, 0xfffffff7
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xa0
mov ecx, dword [ebp - 0x1ec]
test ecx, ecx
je 0x47d983
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xa1
mov ecx, dword [ebp - 0x1f0]
test ecx, ecx
je 0x47d997
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xa2
mov ecx, dword [ebp - 0x1f4]
test ecx, ecx
je 0x47d9ae
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xa3
mov ecx, dword [ebp - 0x1f8]
test ecx, ecx
je 0x47d9c5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x93
mov eax, dword [ebp - 0x1c]
test al, 4
je 0x47da01
and eax, 0xfffffffb
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xa4
mov ecx, dword [ebp - 0x1fc]
test ecx, ecx
je 0x47d9ed
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xa5
mov ecx, dword [ebp - 0x200]
test ecx, ecx
je 0x47da01
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xa6
mov ecx, dword [ebp - 0x204]
test ecx, ecx
je 0x47da18
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xa7
mov ecx, dword [ebp - 0x208]
test ecx, ecx
je 0x47da2f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x91
mov eax, dword [ebp - 0x1c]
test al, 2
je 0x47da6b
and eax, 0xfffffffd
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xa8
mov ecx, dword [ebp - 0x20c]
test ecx, ecx
je 0x47da57
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xa9
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x47da6b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xaa
mov ecx, dword [ebp - 0x214]
test ecx, ecx
je 0x47da82
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xab
mov ecx, dword [ebp - 0x218]
test ecx, ecx
je 0x47da99
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x8f
mov eax, dword [ebp - 0x1c]
test al, 1
je 0x47dad5
and eax, 0xfffffffe
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xac
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x47dac1
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xad
mov ecx, dword [ebp - 0x220]
test ecx, ecx
je 0x47dad5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xae
mov ecx, dword [ebp - 0x224]
test ecx, ecx
je 0x47daec
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xaf
mov ecx, dword [ebp - 0x228]
test ecx, ecx
je 0x47db03
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x8c
test edi, edi
jns 0x47db3f
and edi, 0x7fffffff
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0xb0
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x47db2b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb1
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x47db3f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xb2
mov ecx, dword [ebp - 0x234]
test ecx, ecx
je 0x47db56
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xb3
mov ecx, dword [ebp - 0x238]
test ecx, ecx
je 0x47db6d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x89
test edi, 0x40000000
je 0x47dbad
and edi, 0xbfffffff
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0xb4
mov ecx, dword [ebp - 0x23c]
test ecx, ecx
je 0x47db99
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb5
mov ecx, dword [ebp - 0x240]
test ecx, ecx
je 0x47dbad
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xb6
mov ecx, dword [ebp - 0x244]
test ecx, ecx
je 0x47dbc4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xb7
mov ecx, dword [ebp - 0x248]
test ecx, ecx
je 0x47dbdb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x86
mov ecx, dword [ebp - 0x10]
test ecx, 0x20000000
je 0x47dc14
mov edx, dword [ebp - 0x60]
and ecx, 0xdfffffff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47dc14
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x85
test ecx, 0x10000000
je 0x47dc4d
mov edx, dword [ebp - 0xb4]
and ecx, 0xefffffff
mov dword [ebp - 0x10], ecx
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47dc4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0x84
test ecx, 0x8000000
je 0x47dc8d
and ecx, 0xf7ffffff
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 0xb8
mov ecx, dword [ebp - 0x24c]
test ecx, ecx
je 0x47dc79
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb9
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x47dc8d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xba
mov ecx, dword [ebp - 0x254]
test ecx, ecx
je 0x47dca4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xbb
mov ecx, dword [ebp - 0x258]
test ecx, ecx
je 0x47dcbb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0x81
mov edi, dword [ebp - 0x10]
test edi, 0x4000000
je 0x47dcfe
and edi, 0xfbffffff
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 0xbc
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
je 0x47dcea
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xbd
mov ecx, dword [ebp - 0x260]
test ecx, ecx
je 0x47dcfe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xbe
mov ecx, dword [ebp - 0x264]
test ecx, ecx
je 0x47dd12
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xbf
mov ecx, dword [ebp - 0x268]
test ecx, ecx
je 0x47dd26
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba170
push str.textbox
push dword [eax]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0xb8]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47dd6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x47e057
push str.fontface
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x18]
call fcn.004b93a0
mov byte [ebp - 4], 0xc1
mov eax, dword [eax]
cmp dword [eax - 0xc], esi
jne 0x47dd9b
mov esi, 0x508cdc
jmp 0x47ddbc
push str.fontface
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x18]
call fcn.004b93a0
mov byte [ebp - 4], 0xc2
or dword [ebp - 0x1c], 0x80
mov esi, dword [eax]
call fcn.00401bb0
mov ecx, eax
test ecx, ecx
je 0x47e78a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0xc3
test esi, esi
je 0x47de0b
test esi, 0xffff0000
jne 0x47ddf9
movzx eax, si
lea ecx, [ebp + 8]
push eax
call fcn.004062a0
jmp 0x47de17
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x47de00
sub ecx, edx
jmp 0x47de0d
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.00401820
push str.fontsize
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xc4
call fcn.004b8fd0
test eax, eax
jne 0x47de38
mov dword [ebp - 0x20], 0xe
jmp 0x47de48
push str.fontsize
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
mov dword [ebp - 0x20], eax
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
test eax, eax
jne 0x47de63
movsd xmm0, qword [0x514520]
jmp 0x47de78
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push str.width
lea ecx, [ebp - 0x18]
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
test eax, eax
jne 0x47de98
movsd xmm0, qword [0x514560]
jmp 0x47dead
push str.width
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
lea eax, [ebp - 0x278]
movsd qword [ebp - 0x38], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba5e0
push 0
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0xc5
push ecx
mov ecx, eax
call fcn.004ba8e0
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xc6
push ecx
mov ecx, eax
call fcn.004b9f60
mov esi, eax
push str.fontbold
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc7
call fcn.004b8fd0
test eax, eax
lea eax, [ebp + 8]
setne cl
movzx ecx, cl
push ecx
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
push str.color
call fcn.004b8fd0
movsd xmm0, qword [ebp - 0x2c]
lea ecx, [ebp - 0x18]
push eax
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x38]
movsd qword [esp], xmm0
push str.left
call fcn.004b8fd0
push 0x508f5c
lea ecx, [ebp - 0x18]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
mov ecx, dword [ebp - 0x30]
movsd xmm3, qword [ebp - 0x2c]
push esi
movd xmm2, eax
cvtdq2pd xmm2, xmm2
lea ecx, [ecx + 0x34]
call fcn.0046a1e0
mov byte [ebp - 4], 0xc6
or eax, 0xffffffff
mov edx, dword [ebp - 0xbc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47df92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc8
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
je 0x47dfa6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xc9
mov ecx, dword [ebp - 0x270]
test ecx, ecx
je 0x47dfba
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xca
mov ecx, dword [ebp - 0x274]
test ecx, ecx
je 0x47dfce
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xcb
mov ecx, dword [ebp - 0x278]
test ecx, ecx
je 0x47dfe2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xc2
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e001
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xc1
mov eax, dword [ebp - 0x1c]
test al, al
jns 0x47e035
mov edx, dword [ebp - 0xc0]
and eax, 0xffffff7f
mov dword [ebp - 0x1c], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e035
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov edx, dword [ebp - 0xc4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e057
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba170
push str.table
push dword [eax]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0xc8]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47e09a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x47e39a
push str.paste
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
cmp eax, 1
jne 0x47e20b
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba5e0
push esi
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0xcd
push ecx
mov ecx, eax
call fcn.004ba8e0
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0xce
push ecx
mov ecx, eax
call fcn.004b9f60
mov byte [ebp - 4], 0xcf
mov esi, dword [eax]
push 0
push 0
mov eax, dword [esi - 0xc]
push eax
push esi
push 0
push 3
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push 0
mov dword [ebp + 8], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x47e79e
push dword [ebp + 8]
push eax
push dword [ebp - 0x20]
push esi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0xc
call dword [sym.imp.mfc140.dll_Ordinal_1507]
mov esi, eax
add esp, 4
mov dword [ebp - 0xe4], esi
mov byte [ebp - 4], 0xd0
test esi, esi
je 0x47e16f
push dword [ebp - 0x24]
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x47e794
jmp 0x47e171
xor esi, esi
mov byte [ebp - 4], 0xcf
mov dword [ebp + 8], esi
test esi, esi
je 0x47e794
lea eax, [ebp + 8]
mov byte [ebp - 4], 0xd1
push eax
call fcn.0047fd10
lea ecx, [ebp + 8]
call fcn.00434ed0
mov byte [ebp - 4], 0xce
or eax, 0xffffffff
mov edx, dword [ebp - 0xcc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e1b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd2
mov ecx, dword [ebp - 0x27c]
test ecx, ecx
je 0x47e1cb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xd3
mov ecx, dword [ebp - 0x280]
test ecx, ecx
je 0x47e1df
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xd4
mov ecx, dword [ebp - 0x284]
test ecx, ecx
je 0x47e1f3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xd5
mov ecx, dword [ebp - 0x288]
test ecx, ecx
je 0x47e207
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
test eax, eax
jne 0x47e226
movsd xmm0, qword [0x514520]
jmp 0x47e23b
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push str.width
lea ecx, [ebp - 0x18]
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
test eax, eax
jne 0x47e25b
movsd xmm0, qword [0x514560]
jmp 0x47e270
push str.width
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
lea eax, [ebp - 0x298]
movsd qword [ebp - 0x38], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba5e0
push 0
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xd6
push ecx
mov ecx, eax
call fcn.004ba8e0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0xd7
push ecx
mov ecx, eax
call fcn.004b9f60
mov esi, eax
push str.paste
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xd8
call fcn.004b8fd0
push eax
push str.color
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movsd xmm0, qword [ebp - 0x2c]
lea ecx, [ebp - 0x18]
push eax
sub esp, 0x10
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x38]
movsd qword [esp], xmm0
push str.left
call fcn.004b8fd0
push 0x508f5c
lea ecx, [ebp - 0x18]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
mov ecx, dword [ebp - 0x30]
movsd xmm3, qword [ebp - 0x2c]
push esi
movd xmm2, eax
cvtdq2pd xmm2, xmm2
lea ecx, [ecx + 0x34]
call fcn.0046a660
mov byte [ebp - 4], 0xd7
or eax, 0xffffffff
mov edx, dword [ebp - 0xd0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e346
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xd9
mov ecx, dword [ebp - 0x28c]
test ecx, ecx
je 0x47e35a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xda
mov ecx, dword [ebp - 0x290]
test ecx, ecx
je 0x47e36e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xdb
mov ecx, dword [ebp - 0x294]
test ecx, ecx
je 0x47e382
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xdc
mov ecx, dword [ebp - 0x298]
test ecx, ecx
je 0x47e396
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba170
push str.chart
push dword [eax]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0xd4]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47e3dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x47e558
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
test eax, eax
jne 0x47e400
movsd xmm0, qword [0x514520]
jmp 0x47e415
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push str.width
lea ecx, [ebp - 0x18]
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
test eax, eax
jne 0x47e435
movsd xmm0, qword [0x514560]
jmp 0x47e44a
push str.width
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
lea eax, [ebp - 0x2a8]
movsd qword [ebp - 0x38], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba5e0
push 0
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0xde
push ecx
mov ecx, eax
call fcn.004ba8e0
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0xdf
push ecx
mov ecx, eax
call fcn.004b9f60
mov esi, eax
movsd xmm0, qword [ebp - 0x2c]
lea ecx, [ebp - 0x18]
sub esp, 0x10
mov byte [ebp - 4], 0xe0
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x38]
movsd qword [esp], xmm0
push str.left
call fcn.004b8fd0
push 0x508f5c
lea ecx, [ebp - 0x18]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
mov ecx, dword [ebp - 0x30]
movsd xmm3, qword [ebp - 0x2c]
push esi
movd xmm2, eax
cvtdq2pd xmm2, xmm2
lea ecx, [ecx + 0x34]
call fcn.0046ef20
mov byte [ebp - 4], 0xdf
or eax, 0xffffffff
mov edx, dword [ebp - 0xd8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e504
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe1
mov ecx, dword [ebp - 0x29c]
test ecx, ecx
je 0x47e518
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xe2
mov ecx, dword [ebp - 0x2a0]
test ecx, ecx
je 0x47e52c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xe3
mov ecx, dword [ebp - 0x2a4]
test ecx, ecx
je 0x47e540
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xe4
mov ecx, dword [ebp - 0x2a8]
test ecx, ecx
je 0x47e554
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x18]
call fcn.004ba170
push str.image
push dword [eax]
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0xdc]
mov esi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x47e59b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x47e6f2
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
test eax, eax
jne 0x47e5be
movsd xmm0, qword [0x514548]
jmp 0x47e5d5
push str.height
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
push str.width
lea ecx, [ebp - 0x18]
movsd qword [ebp - 0x2c], xmm0
call fcn.004b8fd0
test eax, eax
jne 0x47e5f5
movsd xmm0, qword [0x514568]
jmp 0x47e60c
push str.width
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
push str.left
lea ecx, [ebp - 0x18]
movsd qword [ebp - 0x38], xmm0
call fcn.004b8fd0
test eax, eax
jne 0x47e62c
movsd xmm0, qword [0x514508]
jmp 0x47e643
push str.left
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
push 0x508f5c
lea ecx, [ebp - 0x18]
movsd qword [ebp - 0x70], xmm0
call fcn.004b8fd0
test eax, eax
jne 0x47e663
movsd xmm0, qword [0x514518]
jmp 0x47e67a
push 0x508f5c
lea ecx, [ebp - 0x18]
call fcn.004b8fd0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
lea eax, [ebp - 0xe0]
movsd qword [ebp - 0x68], xmm0
push eax
lea ecx, [ebp - 0x18]
call fcn.004b9e30
movsd xmm0, qword [ebp - 0x2c]
sub esp, 8
movsd xmm3, qword [ebp - 0x70]
movsd xmm2, qword [ebp - 0x68]
mov ecx, dword [ebp - 0x30]
cvtpd2ps xmm0, xmm0
mov byte [ebp - 4], 0xe6
lea ecx, [ecx + 0x34]
cvtpd2ps xmm3, xmm3
movss dword [esp + 4], xmm0
movsd xmm0, qword [ebp - 0x38]
cvtpd2ps xmm0, xmm0
cvtpd2ps xmm2, xmm2
movss dword [esp], xmm0
push eax
call fcn.00468ed0
mov byte [ebp - 4], 0xb
or eax, 0xffffffff
mov edx, dword [ebp - 0xe0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e6f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
mov dword [ebp + 8], eax
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
jmp 0x47bfba
mov byte [ebp - 4], 0xe7
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x47e71b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [ebp - 0x7c]
mov byte [ebp - 4], 0xe8
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x47e72f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [ebp - 0x7c]
mov byte [ebp - 4], 0xe9
mov ecx, dword [ebp - 0x78]
test ecx, ecx
je 0x47e743
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [ebp - 0x7c]
mov byte [ebp - 4], 0xea
test esi, esi
je 0x47e751
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov dword [ebp - 4], 0xeb
mov eax, dword [ebp - 0x40]
pop edi
pop esi
test eax, eax
je 0x47e76c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0xed
test eax, eax
je 0x47e77a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00401f30
push 0x8007000e
call fcn.004e2be0
call fcn.00401d50
int3