Function at 0x4d6840
Capabilities:
Check for unmoving mouse cursor
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5862e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4f4
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0xec]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xf0]
mov edi, 2
add eax, edi
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xec]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
mov ecx, dword [esp + 0x514]
mov eax, ecx
and eax, 1
cmp eax, 1
mov dword [esp + 0x34], eax
je 0x4d68c6
and ecx, edi
cmp cl, 2
jne 0x4d837c
mov ecx, dword [esp + 0x518]
mov eax, dword [esi + 0x1c4]
mov edx, dword [esp + 0x51c]
mov dword [esi + 0x1fc], ecx
cmp eax, 9
mov dword [esi + 0x200], edx
je 0x4d6906
mov eax, dword [esi + 0x204]
test eax, eax
je 0x4d68fc
mov ecx, esi
call fcn.004de650
mov dword [esi + 0x204], 0
cmp dword [esi + 0x1c4], 0xd
je 0x4d692d
cmp dword [esi + 0x230], edi
jl 0x4d691e
mov ecx, esi
call fcn.004de650
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x228]
call fcn.004e04a0
mov edx, dword [esi + 0x1c4]
mov eax, dword [esi + 0x1c8]
xor ecx, ecx
cmp edx, eax
je 0x4d6944
mov ecx, 1
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov ebp, eax
test ecx, ecx
mov dword [esp + 0x4c], ebp
jne 0x4d6ad4
cmp edx, 7
jne 0x4d69ec
cmp dword [esi + 0x1bc], 1
jne 0x4d69ec
lea eax, [esp + 0x1c]
push eax
call ebx
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
call edi
lea eax, [esi + 0x18c]
mov ecx, dword [esi + 0x18c]
mov dword [esp + 0x50], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x54], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push eax
push ecx
lea ecx, [esi + 0x8c]
mov dword [esp + 0x64], edx
call sub.MFC42.DLL_CRectTracker::HitTest
cmp eax, 0xffffffff
je 0x4d69ca
cmp eax, 8
jne 0x4d7247
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
lea ecx, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d7247
jmp 0x4d6aca
cmp edx, 1
jne 0x4d6a5e
cmp dword [esi + 0x1bc], edx
jne 0x4d6a5e
lea edx, [esp + 0x64]
push edx
call ebx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x64]
push eax
push ecx
call edi
lea edx, [esi + 0x19c]
mov eax, dword [esi + 0x19c]
mov dword [esp + 0x98], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x9c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x68]
mov dword [esp + 0xa4], ecx
push edx
lea ecx, [esp + 0x9c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d7247
jmp 0x4d6aca
cmp edx, 0x10
jne 0x4d7247
lea edx, [esp + 0x64]
push edx
call ebx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x64]
push eax
push ecx
call edi
lea edx, [esi + 0x19c]
mov eax, dword [esi + 0x19c]
mov dword [esp + 0x98], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x9c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x68]
mov dword [esp + 0xa4], ecx
push edx
lea ecx, [esp + 0x9c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d7247
mov ebp, dword [esi + 0x1c4]
mov dword [esp + 0x4c], ebp
cmp dword [esi + 0x1bc], 1
jne 0x4d7247
cmp ebp, 7
je 0x4d6af4
cmp ebp, 1
je 0x4d6af4
cmp ebp, 0x10
jne 0x4d7247
mov eax, ebp
dec eax
je 0x4d7032
sub eax, 6
je 0x4d6c70
sub eax, 9
jne 0x4d720e
lea edx, [esp + 0x10]
push edx
call ebx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x19c]
mov edx, edi
mov eax, dword [edx]
mov dword [esp + 0x1c], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x20], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d720e
push esi
lea ecx, [esp + 0x3c]
call fcn.00572dba
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x80]
push edx
push eax
mov dword [esp + 0x514], 2
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [esp + 0x88]
mov ebx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
sub ebp, ebx
mov ebx, dword [esp + 0x8c]
lea eax, [esi + 0x104]
sub ebx, edx
test eax, eax
je 0x4d6bbc
mov eax, dword [esi + 0x108]
mov ecx, dword [esp + 0x3c]
push 0xcc0020
push 0
push 0
push eax
push ebx
push ebp
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004de650
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
mov dword [esp + 0x18], edi
lea edi, [esi + 0x174]
sub ecx, edx
mov edx, dword [esi + 0x1a0]
test edi, edi
je 0x4d6c06
mov edi, dword [edi + 4]
push 0xcc0020
push 0
push 0
push edi
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push eax
mov eax, dword [esi + 0x108]
push ecx
push edx
mov edx, dword [esp + 0x34]
push edx
push eax
call edi
lea eax, [esi + 0x104]
test eax, eax
je 0x4d6c34
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x3c]
push 0xcc0020
push 0
push 0
push eax
push ebx
push ebp
push 0
push 0
push ecx
call edi
mov edx, dword [esi + 0x1cc]
or eax, 0xffffffff
mov dword [esi + 0x1bc], eax
mov dword [esi + 0x1c4], edx
mov dword [esp + 0x50c], eax
lea ecx, [esp + 0x38]
jmp 0x4d71ff
push esi
lea ecx, [esp + 0xac]
call fcn.00572dba
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x6c]
push eax
push ecx
mov dword [esp + 0x514], 3
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x78]
mov edi, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov ebx, dword [esp + 0x6c]
sub edx, edi
lea edi, [esi + 0x104]
sub ecx, ebx
mov dword [esp + 0x80], edx
test edi, edi
mov dword [esp + 0x1c], ecx
jne 0x4d6cc4
xor eax, eax
jmp 0x4d6cc7
mov eax, dword [edi + 4]
push 0xcc0020
push 0
push 0
push eax
push edx
mov edx, dword [esp + 0xc0]
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x5f3788
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 0x60]
mov byte [esp + 0x50c], 4
test eax, eax
je 0x4d6d0f
lea eax, [esp + 0x18]
lea ecx, [esi + 0x40]
push eax
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov ecx, dword [esp + 0x18]
push 0x5f3788
push ecx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x4d6d2d
mov ecx, esi
call fcn.004de650
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea ebx, [esi + 0x18c]
mov edx, ebx
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x3c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
push edx
push eax
lea ecx, [esi + 0x8c]
call sub.MFC42.DLL_CRectTracker::HitTest
cmp eax, 0xffffffff
je 0x4d6d94
cmp eax, 8
je 0x4d6d94
mov dword [esi + 0x1c0], eax
jmp 0x4d7005
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d7005
mov eax, dword [esi + 0xfc]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x38]
cmp dword [esi + 0x1f0], 1
jne 0x4d6dd3
push 1
mov ecx, edi
call sub.MFC42.DLL_CDC::SetBkMode
jmp 0x4d6dea
push 2
mov ecx, edi
call sub.MFC42.DLL_CDC::SetBkMode
mov eax, dword [esi + 0x100]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x34]
cmp dword [esi + 0x1f0], 2
jne 0x4d6e19
mov edx, dword [edi]
push 8
mov ecx, edi
call dword [edx + 0x2c]
mov ebp, eax
mov eax, dword [esi + 0x100]
push eax
push ebx
mov ecx, edi
call sub.MFC42.DLL_CDC::FillSolidRect_1
test ebp, ebp
je 0x4d6e19
push ebp
mov ecx, edi
call sub.MFC42.DLL_CDC::SelectObject
mov eax, dword [esi + 0x60]
test eax, eax
je 0x4d6f9a
push 0x5f3788
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString_3
push 0x5f3788
lea ecx, [esp + 0x34]
mov byte [esp + 0x510], 5
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 6
push ecx
lea ecx, [esi + 0x40]
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov edx, dword [esp + 0x30]
push 0x5f3788
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x4d6f78
mov eax, dword [edi]
lea ecx, [esi + 0x23c]
push ecx
mov ecx, edi
call dword [eax + 0x30]
mov edx, dword [esi + 0x60]
push 0
push 0
push 0xba
push edx
mov dword [esp + 0x70], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jle 0x4d6f53
mov eax, dword [esi + 0x60]
push 0
push ebp
push 0xbb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x60]
push 0
push eax
push 0xc1
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x4d6f35
mov eax, dword [esi + 0x60]
lea edx, [esp + 0x104]
push edx
push ebp
push 0xc4
push eax
mov word [esp + 0x114], 0x3ff
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x104]
mov byte [esp + eax + 0x104], 0
push ecx
lea ecx, [esp + 0xc0]
call sub.MFC42.DLL_CString::CString_3
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x510], 7
call fcn.00572d2a
lea ecx, [esp + 0xbc]
mov byte [esp + 0x50c], 6
call sub.MFC42.DLL_CString::CString
lea eax, [ebx - 1]
cmp ebp, eax
je 0x4d6f4a
push 0x5e1dc0
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::operator_1
inc ebp
cmp ebp, ebx
jl 0x4d6ea9
mov eax, dword [esp + 0x2c]
mov ebx, dword [edi]
lea edx, [esi + 0x18c]
push 0x10
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov ecx, edi
call dword [ebx + 0x70]
mov eax, dword [esp + 0x60]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x30]
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50c], 4
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0x40]
push 0
mov ecx, ebp
call sub.MFC42.DLL_CWnd::ShowWindow
push 0x5f3788
mov ecx, ebp
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [esi + 0x94]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetRect]
test edi, edi
je 0x4d6fce
mov edi, dword [edi + 4]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xac]
push 0xcc0020
push 0
push 0
push edi
push edx
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ebp, dword [esp + 0x4c]
mov dword [esi + 0x1bc], 0xffffffff
lea ecx, [esp + 0x18]
mov byte [esp + 0x50c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xa8]
mov dword [esp + 0x50c], 0xffffffff
call sub.MFC42.DLL_CClientDC::CClientDC
jmp 0x4d7208
lea edx, [esp + 0x10]
push edx
call ebx
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x19c]
mov edx, edi
mov eax, dword [edx]
mov dword [esp + 0x38], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x3c], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [edx + 0xc]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d720e
push esi
lea ecx, [esp + 0xac]
call fcn.00572dba
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x6c]
push edx
push eax
mov dword [esp + 0x514], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x74]
mov ebp, dword [esp + 0x6c]
mov ecx, dword [esp + 0x78]
mov ebx, dword [esp + 0x70]
sub eax, ebp
lea ebp, [esi + 0x104]
sub ecx, ebx
mov dword [esp + 0x80], eax
test ebp, ebp
mov dword [esp + 0x1c], ecx
jne 0x4d70dc
xor edx, edx
jmp 0x4d70df
mov edx, dword [ebp + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0xc0]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004de650
mov edx, dword [ebp]
push 8
mov ecx, ebp
call dword [edx + 0x2c]
push 0xffffff
lea ecx, [esp + 0x54]
mov dword [esp + 0x64], eax
call sub.MFC42.DLL_CBrush::CBrush
test eax, eax
je 0x4d7127
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x108]
push eax
lea eax, [esi + 0x18c]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov dword [esp + 0x50], 0x5916f4
lea ecx, [esp + 0x50]
mov byte [esp + 0x50c], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
lea edx, [esi + 0x174]
sub ecx, ebx
mov ebx, dword [esi + 0x1a0]
mov byte [esp + 0x50c], 0
test edx, edx
mov dword [esp + 0x50], 0x5916e0
je 0x4d7189
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 0x108]
push eax
push ecx
push ebx
push edi
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
test ebp, ebp
jne 0x4d71ac
xor eax, eax
jmp 0x4d71af
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x80]
push 0xcc0020
mov edx, dword [esp + 0xb0]
push 0
push 0
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x60]
or edi, 0xffffffff
test eax, eax
mov dword [esi + 0x1bc], edi
je 0x4d71f1
push eax
mov ecx, ebp
call sub.MFC42.DLL_CDC::SelectObject
mov dword [esp + 0x50c], edi
lea ecx, [esp + 0xa8]
call sub.MFC42.DLL_CClientDC::CClientDC
mov ebp, dword [esp + 0x4c]
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [esi + 0x1c4]
xor ecx, ecx
xor eax, eax
push ecx
push eax
push 1
mov ecx, esi
mov dword [esi + 0x1c4], ebp
call fcn.004dc100
cmp edi, 7
mov dword [esi + 0x1c4], edi
jne 0x4d7247
cmp ebp, edi
jne 0x4d7247
mov dword [esi + 0x1bc], 0xffffffff
jmp 0x4d837c
mov eax, dword [esi + 0x1c4]
dec eax
cmp eax, 0xf
ja case.0x4d725f.9
xor ecx, ecx
mov cl, byte [eax + 0x4d83bc]
jmp dword [ecx*4 + 0x4d8398]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
push esi
lea ecx, [esp + 0xac]
call fcn.00572dba
mov edx, dword [esp + 0x51c]
mov eax, dword [esp + 0x518]
mov ecx, dword [esp + 0xac]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov dword [esi + 0xfc], eax
cmp dword [esp + 0x34], 1
jne 0x4d72b8
lea edx, [esp + 0x18]
push 0
push edx
push 0x178a
jmp 0x4d72d3
mov ecx, dword [esp + 0x514]
and ecx, 2
cmp cl, 2
jne 0x4d72e0
lea edx, [esp + 0x18]
push 0
push edx
push 0x178b
mov eax, dword [esi + 0x24c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0xa8]
jmp 0x4d835d
push esi
lea ecx, [esp + 0x70]
call fcn.00572dba
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x38]
push ecx
push edx
mov dword [esp + 0x514], 8
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x591ae8
lea eax, [esp + 0x38]
mov byte [esp + 0x50c], 9
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::Attach
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x70]
call sub.MFC42.DLL_CDC::SelectObject_2
cmp dword [esp + 0x34], 1
jne 0x4d735a
mov eax, dword [esi + 0xfc]
jmp 0x4d7360
mov eax, dword [esi + 0x100]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CBrush::CBrush
lea edx, [esp + 0x10]
lea ecx, [esp + 0x6c]
push edx
mov byte [esp + 0x510], 0xa
call sub.MFC42.DLL_CDC::SelectObject_1
mov ebx, dword [esp + 0x51c]
mov edi, dword [esp + 0x518]
mov eax, dword [esp + 0x70]
push ebx
push edi
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, dword [esp + 0x70]
push 1
push eax
push ebx
push edi
push ecx
call dword [sym.imp.GDI32.dll_ExtFloodFill]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
call fcn.004de650
mov edi, 0x5916f4
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0xb
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ebx, 0x5916e0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50c], 0xc
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x6c]
jmp 0x4d835d
mov ecx, dword [esp + 0x34]
mov eax, 1
xor edi, edi
cmp ecx, eax
mov dword [esp + 0x30], edi
jne 0x4d742b
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x514]
mov dword [esp + 0x18], edi
and edx, 8
cmp dl, 8
jne 0x4d7442
mov dword [esp + 0x18], eax
push esi
lea ecx, [esp + 0x70]
call fcn.00572dba
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x38]
push eax
push ecx
mov dword [esp + 0x514], 0xd
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], 0x591ae8
lea edx, [esp + 0x38]
mov byte [esp + 0x50c], 0xe
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x84]
call sub.MFC42.DLL_CGdiObject::Attach
lea eax, [esp + 0x80]
lea ecx, [esp + 0x6c]
push eax
call sub.MFC42.DLL_CDC::SelectObject_2
mov eax, dword [esi + 0x1e0]
mov dword [esp + 0x2c], edi
lea ecx, [eax + eax*4]
shl ecx, 2
js 0x4d75e0
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
mov edi, dword [esi + 0x1e0]
call ebx
cdq
lea ecx, [edi + edi]
idiv ecx
mov ebp, edx
sub ebp, edi
mov edi, dword [esi + 0x1e0]
call ebx
cdq
lea ecx, [edi + edi]
idiv ecx
mov ecx, ebp
imul ecx, ebp
sub edx, edi
mov eax, edx
mov dword [esp + 0x1c], edx
imul eax, edx
add eax, ecx
mov ecx, edi
imul ecx, edi
cmp eax, ecx
jg 0x4d75c3
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4d7544
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4d751c
mov eax, dword [esi + 0xfc]
jmp 0x4d7522
mov eax, dword [esi + 0x100]
mov ecx, dword [esp + 0x518]
push eax
mov eax, dword [esp + 0x520]
add ebp, ecx
add edx, eax
push edx
mov edx, dword [esp + 0x78]
push ebp
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x4d75c3
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
call ebx
mov edi, eax
and edi, 0x800000ff
jns 0x4d755e
dec edi
or edi, 0xffffff00
inc edi
call ebx
mov ebx, eax
and ebx, 0x800000ff
jns 0x4d7572
dec ebx
or ebx, 0xffffff00
inc ebx
call dword [sym.imp.MSVCRT.dll_rand]
and eax, 0x800000ff
jns 0x4d7586
dec eax
or eax, 0xffffff00
inc eax
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov ch, al
and edi, 0xff
mov cl, bl
shl ecx, 8
or ecx, edi
mov eax, ecx
mov ecx, dword [esp + 0x518]
push eax
mov eax, dword [esp + 0x520]
add edx, eax
add ebp, ecx
push edx
mov edx, dword [esp + 0x78]
push ebp
push edx
call dword [sym.imp.GDI32.dll_SetPixel]
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
mov eax, dword [esi + 0x1e0]
mov ecx, dword [esp + 0x2c]
inc ecx
lea eax, [eax + eax*4]
mov dword [esp + 0x2c], ecx
shl eax, 2
cmp ecx, eax
jle 0x4d74c5
lea ecx, [esp + 0x80]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x80], 0x5916f4
lea ecx, [esp + 0x80]
mov byte [esp + 0x50c], 0xf
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x80], 0x5916e0
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x6c]
jmp 0x4d835d
mov edx, dword [esi + 0x204]
inc edx
mov eax, edx
mov dword [esi + 0x204], edx
cmp eax, 1
jne 0x4d7665
lea eax, [esi + 0x208]
mov ecx, 4
mov edx, dword [esi + 0x1fc]
mov dword [eax], edx
mov edx, dword [esi + 0x200]
mov dword [eax + 4], edx
add eax, 8
dec ecx
jne 0x4d7649
jmp case.0x4d725f.9
cmp eax, 2
jne 0x4d77e9
mov eax, dword [esp + 0x34]
xor edi, edi
cmp eax, 1
jne 0x4d767e
mov edi, 1
push esi
lea ecx, [esp + 0x3c]
call fcn.00572dba
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x50]
push eax
push ecx
mov dword [esp + 0x514], 0x10
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x591ae8
lea edx, [esp + 0x50]
mov byte [esp + 0x50c], 0x11
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::Attach
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
call sub.MFC42.DLL_CDC::SelectObject_2
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esi + 0x104]
sub ecx, ebp
test edx, edx
je 0x4d76fe
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
test edi, edi
je 0x4d7725
mov eax, dword [esi + 0xfc]
jmp 0x4d772b
mov eax, dword [esi + 0x100]
mov edx, dword [esi + 0x1e4]
push eax
mov eax, dword [esi + 0x1d4]
push edx
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CPen::CPen
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x12
push ecx
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esp + 0x518]
mov eax, dword [esp + 0x51c]
mov dword [esi + 0x210], edx
mov edx, dword [esp + 0x3c]
lea ecx, [esi + 0x208]
push 4
push ecx
push edx
mov dword [esi + 0x214], eax
call dword [sym.imp.GDI32.dll_PolyBezier]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov edi, 0x5916f4
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x13
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ebx, 0x5916e0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50c], 0x14
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x38]
jmp 0x4d835d
cmp eax, 3
jne case.0x4d725f.9
mov eax, dword [esp + 0x34]
xor edi, edi
cmp eax, 1
jne 0x4d7802
mov edi, 1
push esi
lea ecx, [esp + 0x3c]
call fcn.00572dba
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x50]
push eax
push ecx
mov dword [esp + 0x514], 0x15
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x591ae8
lea edx, [esp + 0x50]
mov byte [esp + 0x50c], 0x16
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::Attach
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
call sub.MFC42.DLL_CDC::SelectObject_2
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
sub eax, ecx
mov ecx, dword [esp + 0x5c]
lea edx, [esi + 0x104]
sub ecx, ebp
test edx, edx
je 0x4d7882
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
test edi, edi
je 0x4d78a9
mov eax, dword [esi + 0xfc]
jmp 0x4d78af
mov eax, dword [esi + 0x100]
mov edx, dword [esi + 0x1e4]
push eax
mov eax, dword [esi + 0x1d4]
push edx
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CPen::CPen
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x17
push ecx
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CDC::SelectObject
mov edx, dword [esp + 0x518]
mov eax, dword [esp + 0x51c]
mov dword [esi + 0x218], edx
mov edx, dword [esp + 0x3c]
lea ecx, [esi + 0x208]
push 4
push ecx
push edx
mov dword [esi + 0x21c], eax
call dword [sym.imp.GDI32.dll_PolyBezier]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov edi, 0x5916f4
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x18
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ebx, 0x5916e0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50c], 0x19
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x38]
jmp 0x4d835d
cmp dword [esi + 0x230], 1
jl case.0x4d725f.9
push esi
lea ecx, [esp + 0x3c]
call fcn.00572dba
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x50]
push eax
push ecx
mov dword [esp + 0x514], 0x1a
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x591ae8
lea edx, [esp + 0x50]
mov byte [esp + 0x50c], 0x1b
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CGdiObject::Attach
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
call sub.MFC42.DLL_CDC::SelectObject_2
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x50]
mov ecx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x54]
lea edx, [esi + 0x104]
sub eax, ebp
sub ecx, ebx
test edx, edx
je 0x4d79fa
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
mov ecx, dword [esp + 0x50]
push eax
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esi + 0xfc]
mov eax, dword [esi + 0x1e4]
mov ecx, dword [esi + 0x1d4]
push edx
push eax
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CPen::CPen
lea edx, [esp + 0x10]
lea ecx, [esp + 0x38]
push edx
mov byte [esp + 0x510], 0x1c
call sub.MFC42.DLL_CDC::SelectObject
mov ecx, dword [esi + 0x22c]
lea edx, [esp + 0xfc]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ecx
push eax
push edx
lea ecx, [esp + 0x44]
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esi + 0x230]
xor edi, edi
test eax, eax
jle 0x4d7a96
mov ecx, dword [esi + 0x22c]
mov eax, dword [ecx + edi*8]
mov ecx, dword [ecx + edi*8 + 4]
push ecx
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CDC::LineTo
mov eax, dword [esi + 0x230]
inc edi
cmp edi, eax
jl 0x4d7a73
mov edx, dword [esp + 0x51c]
mov eax, dword [esp + 0x518]
push edx
push eax
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CDC::LineTo
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov edi, 0x5916f4
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x50c], 0x1d
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ebx, 0x5916e0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50c], 0x1e
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0x38]
jmp 0x4d835d
mov eax, dword [esi + 0x1bc]
test eax, eax
jg 0x4d7b90
mov edx, dword [esp + 0x51c]
mov ecx, dword [esp + 0x518]
lea eax, [esi + 0x18c]
mov dword [esi + 0x190], edx
mov dword [esi + 0x198], edx
mov edx, eax
mov dword [eax], ecx
mov dword [esi + 0x194], ecx
mov edi, dword [edx]
lea ecx, [esi + 0x19c]
mov dword [esi + 0x1bc], 0
mov dword [ecx], edi
mov edi, dword [edx + 4]
mov dword [ecx + 4], edi
mov edi, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], edx
mov edx, dword [eax]
lea ecx, [esi + 0x1ac]
mov dword [esi + 0x1ac], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
jmp case.0x4d725f.9
lea ecx, [esp + 0x50]
push ecx
call ebx
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x50]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x19c]
mov ecx, edi
mov edx, dword [ecx]
mov dword [esp + 0x38], edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x3c], eax
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x50]
mov eax, dword [ecx + 0xc]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne case.0x4d725f.9
push esi
lea ecx, [esp + 0xac]
call fcn.00572dba
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x6c]
mov ebx, 0x1f
push ecx
push edx
mov dword [esp + 0x514], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
sub eax, ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x80], eax
sub ecx, ebp
lea ebp, [esi + 0x104]
test ebp, ebp
mov dword [esp + 0x1c], ecx
jne 0x4d7c3b
xor edx, edx
jmp 0x4d7c3e
mov edx, dword [ebp + 4]
push 0xcc0020
push 0
push 0
push edx
push ecx
push eax
mov eax, dword [esp + 0xc4]
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004de650
mov edx, dword [ebp]
push 8
mov ecx, ebp
call dword [edx + 0x2c]
push 0xffffff
lea ecx, [esp + 0xc4]
mov dword [esp + 0x64], eax
call sub.MFC42.DLL_CBrush::CBrush
test eax, eax
je 0x4d7c89
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x108]
push eax
lea eax, [esi + 0x18c]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov dword [esp + 0xc0], 0x5916f4
lea ecx, [esp + 0xc0]
mov byte [esp + 0x50c], 0x20
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov byte [esp + 0x50c], bl
mov ebx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
lea edx, [esi + 0x174]
sub ecx, ebx
mov ebx, dword [esi + 0x1a0]
test edx, edx
mov dword [esp + 0xc0], 0x5916e0
je 0x4d7cf3
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esi + 0x108]
push eax
push ecx
push ebx
push edi
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push edx
call edi
test ebp, ebp
jne 0x4d7d18
xor eax, eax
jmp 0x4d7d1b
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x80]
push 0xcc0020
mov edx, dword [esp + 0xb0]
push 0
push 0
push eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push 0
push 0
push edx
call edi
mov eax, dword [esp + 0x60]
or edi, 0xffffffff
test eax, eax
mov dword [esi + 0x1bc], edi
je 0x4d7d59
push eax
mov ecx, ebp
call sub.MFC42.DLL_CDC::SelectObject
mov dword [esp + 0x50c], edi
lea ecx, [esp + 0xa8]
jmp 0x4d835d
lea eax, [esp + 0x50]
push eax
call ebx
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edi, [esi + 0x19c]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x38], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x3c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x44], edx
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne case.0x4d725f.9
push esi
lea ecx, [esp + 0xac]
call fcn.00572dba
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x6c]
push eax
push ecx
mov dword [esp + 0x514], 0x21
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [esp + 0x74]
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x70]
sub ebp, eax
mov eax, dword [esp + 0x78]
lea ecx, [esi + 0x104]
sub eax, ebx
test ecx, ecx
mov dword [esp + 0x1c], eax
je 0x4d7e0e
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 0xac]
push 0xcc0020
push 0
push 0
push ecx
push eax
push ebp
push 0
push 0
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, esi
call fcn.004de650
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov ebx, dword [edi]
sub eax, ecx
mov ecx, dword [edi + 8]
mov edi, dword [edi]
lea edx, [esi + 0x174]
sub ecx, ebx
mov ebx, dword [esi + 0x1a0]
test edx, edx
je 0x4d7e57
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
push eax
mov eax, dword [esi + 0x108]
push ecx
push ebx
push edi
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
push eax
call edi
lea eax, [esi + 0x104]
test eax, eax
je 0x4d7e81
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xac]
push 0xcc0020
push 0
push 0
push eax
push ecx
push ebp
push 0
push 0
push edx
call edi
mov ecx, dword [esi + 0x1cc]
or eax, 0xffffffff
mov dword [esi + 0x1c4], ecx
mov dword [esi + 0x1bc], eax
mov dword [esp + 0x50c], eax
lea ecx, [esp + 0xa8]
jmp 0x4d835d
mov eax, dword [esi + 0x1bc]
test eax, eax
jg 0x4d7f06
mov eax, dword [esp + 0x518]
mov ecx, dword [esp + 0x51c]
mov dword [esi + 0x1bc], 0
mov dword [esi + 0x18c], eax
mov dword [esi + 0x190], ecx
mov dword [esi + 0x194], eax
mov dword [esi + 0x198], ecx
jmp case.0x4d725f.9
push esi
lea ecx, [esp + 0xdc]
call fcn.00572dba
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x98]
push edx
push eax
mov dword [esp + 0x514], 0x22
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x94], 0
mov dword [esp + 0x90], 0x591ae8
lea ecx, [esp + 0x98]
mov byte [esp + 0x50c], 0x23
push ecx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x94]
call sub.MFC42.DLL_CGdiObject::Attach
lea edx, [esp + 0x90]
lea ecx, [esp + 0xd8]
push edx
call sub.MFC42.DLL_CDC::SelectObject_2
mov ebx, dword [esp + 0xa0]
mov edi, dword [esp + 0x98]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0x9c]
sub ebx, edi
lea edi, [esi + 0x104]
sub ecx, edx
mov dword [esp + 0x80], ebx
test edi, edi
mov dword [esp + 0x60], ecx
jne 0x4d7fb6
xor eax, eax
jmp 0x4d7fb9
mov eax, dword [edi + 4]
push 0xcc0020
push 0
push 0
push eax
mov eax, dword [esp + 0xec]
push ecx
push ebx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x5f3788
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esi + 0x60]
mov byte [esp + 0x50c], 0x24
test eax, eax
je 0x4d8001
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esi + 0x40]
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov edx, dword [esp + 0x34]
push 0x5f3788
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x4d801f
mov ecx, esi
call fcn.004de650
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x64]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esi + 0x18c]
mov ecx, dword [esi + 0x18c]
mov dword [esp + 0xc8], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0xcc], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xd0], ecx
mov ecx, dword [esp + 0x64]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x68]
push eax
push ecx
lea ecx, [esi + 0x8c]
mov dword [esp + 0xdc], edx
call sub.MFC42.DLL_CRectTracker::HitTest
cmp eax, 0xffffffff
je 0x4d8094
cmp eax, 8
je 0x4d8094
mov dword [esi + 0x1c0], eax
jmp 0x4d8304
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
push edx
lea ecx, [esp + 0xcc]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d8304
mov eax, dword [esi + 0xfc]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x38]
cmp dword [esi + 0x1f0], 1
jne 0x4d80d6
push 1
mov ecx, edi
call sub.MFC42.DLL_CDC::SetBkMode
jmp 0x4d80ed
push 2
mov ecx, edi
call sub.MFC42.DLL_CDC::SetBkMode
mov eax, dword [esi + 0x100]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x34]
cmp dword [esi + 0x1f0], 2
jne 0x4d8122
mov edx, dword [edi]
push 8
mov ecx, edi
call dword [edx + 0x2c]
mov ebp, eax
mov eax, dword [esi + 0x100]
push eax
lea eax, [esi + 0x18c]
push eax
mov ecx, edi
call sub.MFC42.DLL_CDC::FillSolidRect_1
test ebp, ebp
je 0x4d8122
push ebp
mov ecx, edi
call sub.MFC42.DLL_CDC::SelectObject
mov eax, dword [esi + 0x60]
test eax, eax
je 0x4d82a4
push 0x5f3788
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString_3
push 0x5f3788
lea ecx, [esp + 0x34]
mov byte [esp + 0x510], 0x25
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 0x26
push ecx
lea ecx, [esi + 0x40]
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov edx, dword [esp + 0x30]
push 0x5f3788
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x4d8282
mov eax, dword [edi]
lea ecx, [esi + 0x23c]
push ecx
mov ecx, edi
call dword [eax + 0x30]
mov edx, dword [esi + 0x60]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xba
push edx
mov dword [esp + 0x2c], eax
call ebx
xor ebp, ebp
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4d8256
mov eax, dword [esi + 0x60]
push 0
push ebp
push 0xbb
push eax
call ebx
mov ecx, dword [esi + 0x60]
push 0
push eax
push 0xc1
push ecx
call ebx
test eax, eax
je 0x4d8230
mov eax, dword [esi + 0x60]
lea edx, [esp + 0x104]
push edx
push ebp
push 0xc4
push eax
mov word [esp + 0x114], 0x3ff
call ebx
lea ecx, [esp + 0x104]
mov byte [esp + eax + 0x104], 0
push ecx
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CString::CString_3
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x510], 0x27
call fcn.00572d2a
lea ecx, [esp + 0x4c]
mov byte [esp + 0x50c], 0x26
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x18]
lea eax, [edx - 1]
cmp ebp, eax
je 0x4d8249
push 0x5e1dc0
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x4d81b6
mov eax, dword [esp + 0x2c]
mov ebx, dword [edi]
lea edx, [esi + 0x18c]
push 0x10
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov ecx, edi
call dword [ebx + 0x70]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x30]
mov ebx, dword [esp + 0x80]
lea ecx, [esp + 0x30]
mov byte [esp + 0x50c], 0x25
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50c], 0x24
call sub.MFC42.DLL_CString::CString
lea ebp, [esi + 0x40]
push 0
mov ecx, ebp
call sub.MFC42.DLL_CWnd::ShowWindow
push 0x5f3788
mov ecx, ebp
call sub.MFC42.DLL_CWnd::SetWindowTextA
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [esi + 0x94]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetRect]
test edi, edi
je 0x4d82d8
mov edi, dword [edi + 4]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0xdc]
push 0xcc0020
push 0
push 0
push edi
push eax
push ebx
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov dword [esi + 0x1bc], 0xffffffff
lea ecx, [esp + 0x90]
call sub.MFC42.DLL_CGdiObject::DeleteObject
lea ecx, [esp + 0x34]
mov byte [esp + 0x50c], 0x23
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0x90], 0x5916f4
lea ecx, [esp + 0x90]
mov byte [esp + 0x50c], 0x28
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 0x90], 0x5916e0
mov dword [esp + 0x50c], 0xffffffff
lea ecx, [esp + 0xd8]
call sub.MFC42.DLL_CClientDC::CClientDC
mov esi, dword [esi + 0x248]
test esi, esi
je 0x4d837c
push 0
push 0
push 0x4c2
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x504]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x500
ret 0xc