Function at 0xb6a6e0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xbca113
mov eax, dword fs:[0]
push eax
sub esp, 0x654
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x4b0], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x488], esi
mov dword [ebp - 0x4ac], edi
mov ecx, dword [edi + 0xf8]
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4cc], 0
test ecx, ecx
js 0xb6a968
mov eax, dword [ebx + 0x24]
test eax, eax
je 0xbeaa9c
mov eax, dword [eax]
cmp ecx, eax
jge 0xb6a968
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 4]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x4cc], ecx
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
cmp esi, 0xb7f9d0
jne 0xbeaaa3
or dword [eax + 0x18], 1
cmp dword [edi], 1
jne 0xb6a962
mov eax, dword [ebx + 0x14]
xor ecx, ecx
mov dword [ebp - 0x48c], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xb6a7d9
mov eax, dword [edx]
lea ecx, [ebp - 0x48c]
push ecx
push edx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x48c]
test cl, 2
je 0xb6a962
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x1c0]
test ecx, ecx
je 0xb6a8a4
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
cmp esi, fcn.00b6ff90
jne 0xbeaada
mov eax, dword [ecx + 0x694]
mov edx, 1
cmp dword [eax], 0
je 0xb6a89c
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 4], 0
mov eax, dword [ecx + 0x694]
mov ecx, dword [ebp - 0x4e4]
mov eax, dword [eax]
mov dword [ebp - 0x4a4], eax
test ecx, ecx
jne 0xbeaab5
mov esi, dword [eax]
lea ecx, [ebp - 0x4e4]
push ecx
push 0x10
push dword [ebp - 0x4cc]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x48c], eax
test eax, eax
js 0xb6a877
cmp dword [ebp - 0x4e4], 0
jne 0xb6a881
mov dword [ebp - 0x48c], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4e4]
test ecx, ecx
jne 0xb6b90e
mov edx, dword [ebp - 0x48c]
test edx, edx
je 0xb6b71e
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x1c0]
test ecx, ecx
je 0xb6a962
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
cmp esi, fcn.00b6ff90
jne 0xbeab1b
mov eax, dword [ecx + 0x694]
mov edx, 1
cmp dword [eax], 0
je 0xb6a95a
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 4], edx
mov eax, dword [ecx + 0x694]
mov ecx, dword [ebp - 0x4e8]
mov eax, dword [eax]
mov dword [ebp - 0x4a4], eax
test ecx, ecx
jne 0xbeaaf6
mov esi, dword [eax]
lea ecx, [ebp - 0x4e8]
push ecx
push 0x13
push dword [ebp - 0x4cc]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x48c], eax
test eax, eax
js 0xb6a935
cmp dword [ebp - 0x4e8], 0
jne 0xb6a93f
mov dword [ebp - 0x48c], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4e8]
test ecx, ecx
jne 0xb6b92d
mov edx, dword [ebp - 0x48c]
test edx, edx
je 0xb6b71e
mov esi, dword [ebp - 0x488]
lea eax, [ebp - 0x53c]
mov ecx, ebx
push eax
push dword [ebp - 0x4b4]
push 1
push edi
call fcn.00b6c160
lea eax, [ebp - 0x53c]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00b6c100
lea eax, [ebp - 0x53c]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00b6bb00
push ecx
lea eax, [ebp - 0x53c]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00bc07ab
lea eax, [ebp - 0x53c]
mov ecx, ebx
push eax
push edi
push esi
call fcn.00b69e80
cmp dword [edi + 0xe8], 0
jne 0xbeab37
mov eax, dword [ebx + 0x14]
xor ecx, ecx
mov dword [ebp - 0x520], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xb6a9fc
mov eax, dword [edx]
lea ecx, [ebp - 0x520]
push ecx
push edx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x520]
test cl, 2
je 0xbeaba3
mov dword [ebp - 0x4d8], 0
mov eax, dword [edi]
mov edi, dword [ebx + 0x14]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x500], 0
mov ecx, dword [edi + 0x30]
test ecx, ecx
je 0xb6aa60
mov eax, dword [ecx]
mov esi, dword [eax + 0x58]
cmp esi, fcn.00b71260
jne 0xbeabd7
test byte [ecx + 0x30], 0x10
jne 0xbeabd0
xor cl, cl
lea eax, [ebp - 0x504]
xor edx, edx
push eax
call fcn.00b70e40
mov esi, dword [0xd08c24]
mov ebx, 1
mov eax, dword [edi + 0x14c]
mov ecx, dword [ebp - 0x504]
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x484], ecx
cmp esi, 0xffffffff
je 0xbeabf0
test esi, esi
je 0xb6aa9c
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, eax
mov ecx, dword [0xd08c28]
cmp ecx, 0xffffffff
je 0xbeac23
cmp dword [0xd0a234], ebx
jne 0xbeac23
push ecx
push 0x60
push dword [ebp - 0x484]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x48c]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [0xd08c24]
mov ebx, 1
mov ecx, dword [ebp - 0x500]
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x484], ecx
cmp esi, 0xffffffff
je 0xbeac72
test esi, esi
je 0xb6ab0b
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, eax
mov ecx, dword [0xd08c28]
cmp ecx, 0xffffffff
je 0xbeaca5
cmp dword [0xd0a234], ebx
jne 0xbeaca5
push ecx
push 0x60
push dword [ebp - 0x484]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x48c]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [edi + 0x10c]
xor ebx, ebx
add esi, dword [edi + 0xfc]
add esi, dword [ebp - 0x504]
add esi, dword [edi + 0x78]
add esi, dword [edi + 0x74]
mov ecx, dword [edi + 0x34]
mov dword [ebp - 0x500], eax
xor eax, eax
mov dword [ebp - 0x4d4], esi
mov dword [ebp - 0x51c], eax
test ecx, ecx
je 0xb6ab9c
mov eax, dword [ecx]
lea edx, [ebp - 0x51c]
push edx
push ecx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x51c]
mov esi, dword [ebp - 0x4d4]
test al, 2
je 0xbeacf4
mov ebx, dword [edi + 0x68]
add ebx, dword [edi + 0x64]
sub ebx, dword [edi + 0x78]
sub ebx, dword [edi + 0x74]
mov ecx, dword [edi + 0x34]
xor eax, eax
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x518], eax
test ecx, ecx
je 0xb6abe2
mov eax, dword [ecx]
lea edx, [ebp - 0x518]
push edx
push ecx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x518]
test al, 2
je 0xb6adc4
mov ecx, dword [edi + 0x34]
test ecx, ecx
je 0xb6ac0c
mov eax, dword [ecx]
mov esi, dword [eax + 0x30]
cmp esi, fcn.00b76080
jne 0xbead52
test byte [ecx + 0x44], 1
jne 0xb6adc4
lea eax, [ebp - 0x470]
push eax
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetParent]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetWindowRect]
test eax, eax
je 0xb6adc4
mov eax, dword [ebp - 0x464]
sub eax, dword [ebp - 0x46c]
mov ecx, dword [edi + 0x30]
mov dword [ebp - 0x4d0], eax
mov eax, dword [edi + 0x60]
add eax, dword [edi + 0x5c]
mov dword [ebp - 0x498], eax
mov eax, dword [edi + 0xf8]
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x510], 0
mov dword [ebp - 0x50c], 0
test ecx, ecx
je 0xb6ac9e
mov eax, dword [ecx]
mov esi, dword [eax + 0x58]
cmp esi, fcn.00b71260
jne 0xbead71
test byte [ecx + 0x30], 0x10
jne 0xbead6a
xor cl, cl
lea eax, [ebp - 0x510]
mov edx, 4
push eax
call fcn.00b70e40
mov eax, dword [edi + 0x14c]
mov esi, dword [0xd08c24]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x484], eax
mov eax, 1
cmp esi, 0xffffffff
je 0xbead8a
test esi, esi
je 0xb6acd8
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [0xd08c28]
cmp ecx, 0xffffffff
je 0xbeadbf
cmp dword [0xd0a234], eax
jne 0xbeadbf
push ecx
push 0x60
push dword [ebp - 0x484]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x48c]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [0xd08c24]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x484], eax
mov eax, 1
cmp esi, 0xffffffff
je 0xbeae0d
test esi, esi
je 0xb6ad45
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [0xd08c28]
cmp ecx, 0xffffffff
je 0xbeae42
cmp dword [0xd0a234], eax
jne 0xbeae42
push ecx
push 0x60
push dword [ebp - 0x484]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x48c]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov ecx, dword [edi + 0x70]
add ecx, dword [edi + 0x6c]
add eax, ecx
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp - 0x50c], eax
lea esi, [eax + ecx]
sub ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x4d0]
cmp esi, 0x29
jne 0xb6ba90
mov eax, 0x63e7063f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jg 0xbeae90
mov edi, dword [ebp - 0x4b0]
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x4d0], eax
sub ebx, dword [eax + 0x10c]
sub ebx, dword [eax + 0xfc]
mov eax, dword [ebp - 0x4ac]
sub ebx, dword [ebp - 0x494]
add ebx, dword [ebp - 0x4d4]
cmp byte [ebp - 0x537], 0
mov esi, dword [eax + 8]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x474], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x4a4], ebx
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x4dc], esi
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x478], edx
jne 0xb6ba40
mov edi, dword [eax + 0x70]
mov dword [ebp - 0x4d4], edi
mov edi, dword [eax + 0x6c]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x48c], edi
mov edi, dword [ebp - 0x4b0]
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x484], eax
test eax, eax
je 0xb6aea0
mov eax, dword [eax]
lea ecx, [ebp - 0x4fc]
push ecx
push dword [ebp - 0x484]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x474]
mov edx, dword [ebp - 0x478]
mov esi, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x480]
mov dword [ebp - 0x4c4], eax
test byte [ebp - 0x4fc], 2
je 0xbeaf6f
mov eax, dword [edi + 0x14]
mov ebx, dword [eax + 0x74]
mov dword [ebp - 0x490], ebx
mov ebx, dword [eax + 0x78]
mov eax, dword [ebp - 0x4c4]
sub edx, ebx
mov ebx, edx
sub ebx, dword [ebp - 0x490]
sub ebx, ecx
mov dword [ebp - 0x4c8], ebx
mov ebx, eax
sub ebx, dword [ebp - 0x4d4]
sub ebx, dword [ebp - 0x48c]
sub ebx, esi
cmp dword [ebp - 0x4c8], 0
jle 0xb6b71e
test ebx, ebx
jle 0xb6b71e
sub eax, dword [ebp - 0x4d4]
add ecx, dword [ebp - 0x490]
add esi, dword [ebp - 0x48c]
mov dword [ebp - 0x474], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x4f8], 0
mov dword [ebp - 0x4f4], 0
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4dc], 0
test ecx, ecx
je 0xb6af80
mov eax, dword [ecx]
mov esi, dword [eax + 0x58]
cmp esi, fcn.00b71260
jne 0xbeb02e
test byte [ecx + 0x30], 0x10
jne 0xbeb027
xor cl, cl
lea eax, [ebp - 0x4f8]
xor edx, edx
push eax
call fcn.00b70e40
mov eax, dword [edi + 0x14]
mov esi, dword [0xd08c24]
mov eax, dword [eax + 0x14c]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x484], eax
mov eax, 1
cmp esi, 0xffffffff
je 0xbeb047
test esi, esi
je 0xb6afbd
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [0xd08c28]
cmp ecx, 0xffffffff
je 0xbeb07c
cmp dword [0xd0a234], eax
jne 0xbeb07c
push ecx
push 0x60
push dword [ebp - 0x484]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x4e0]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [0xd08c24]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x484], eax
mov eax, 1
cmp esi, 0xffffffff
je 0xbeb0ca
test esi, esi
je 0xb6b02a
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [0xd08c28]
cmp ecx, 0xffffffff
je 0xbeb0ff
cmp dword [0xd0a234], eax
jne 0xbeb0ff
push ecx
push 0x60
push dword [ebp - 0x484]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push dword [ebp - 0x4e0]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov esi, dword [ebp - 0x4f8]
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4c4], esi
cmp dword [ebp - 0x4c8], esi
jl 0xbeb14d
cmp ebx, eax
jl 0xbeb14d
cmp dword [ebp - 0x4d8], 0
jne 0xbeb1cc
sub eax, dword [ebp - 0x474]
add eax, dword [ebp - 0x47c]
cdq
sub eax, edx
sar eax, 1
push eax
push 0
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
cmp dword [ebp - 0x4d8], 0
jne 0xb6b0f5
mov ecx, dword [ebp - 0x478]
mov eax, ecx
mov edx, dword [ebp - 0x480]
sub eax, edx
cmp eax, esi
jle 0xb6b0f5
mov eax, esi
sub eax, ecx
add eax, edx
cdq
sub eax, edx
push 0
sar eax, 1
push eax
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_InflateRect]
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [eax + 0xf8]
mov eax, dword [edi + 0x24]
test eax, eax
je 0xb6b7b4
mov eax, dword [eax]
mov dword [ebp - 0x4a8], 0
test ecx, ecx
js 0xb6b13f
cmp ecx, eax
jge 0xb6b13f
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x4a8], eax
cmp dword [edi + 0x28], 0
mov dword [ebp - 0x490], 0
je 0xbeb2bc
cmp dword [edi + 0x28], 1
jne 0xb6b191
mov eax, dword [edi + 0x14]
xor ecx, ecx
mov dword [ebp - 0x514], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xb6b188
mov eax, dword [edx]
lea ecx, [ebp - 0x514]
push ecx
push edx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x514]
test cl, 2
je 0xbeb33c
cmp dword [edi + 0x28], 0
je 0xbeb34d
cmp dword [edi + 0x28], 2
jne 0xb6b73c
xor esi, esi
mov ecx, dword [edi + 0x14]
mov edx, dword [edi + 0x18]
mov dword [ebp - 0x4a8], edx
mov ecx, dword [ecx + 0x30]
mov dword [ebp - 0x4fc], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4bc], eax
cmp eax, fcn.00b75920
jne 0xbeb457
mov dword [ebp - 0x49c], 0xfffffffe
mov eax, dword [edx]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x484], eax
cmp eax, fcn.00b76440
jne 0xbeb3dc
test esi, esi
jne 0xb6b830
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x49c], eax
cmp eax, 0xfffffffe
je 0xb6b94c
mov eax, dword [edx]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4bc], eax
cmp eax, fcn.00b76440
jne 0xbeb423
test esi, esi
jne 0xb6b85d
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x49c], eax
cmp eax, 0xfffffffe
je 0xb6b6e8
mov eax, dword [edi + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov esi, dword [eax + 0x14]
cmp esi, 0xb75890
jne 0xbeb4a1
mov dword [ebp - 0x4ec], 0
mov ecx, dword [ecx + 0x60]
test ecx, ecx
je 0xb6b6e8
mov eax, dword [ecx]
mov esi, dword [eax + 0x10]
cmp esi, 0xb79560
jne 0xbeb4a1
mov dword [ebp - 0x4ec], 0
mov eax, dword [ecx + 0x14]
test eax, eax
je 0xbeb497
xor edx, edx
test eax, eax
je 0xbeb497
mov eax, dword [ecx + 0x10]
mov esi, dword [ebp - 0x4e0]
add eax, 4
cmp dword [eax], esi
jne 0xbeb48a
mov eax, dword [ecx + 0x20]
mov eax, dword [eax + edx*4]
mov dword [ebp - 0x4ec], eax
xor eax, eax
test eax, eax
js 0xb6b6e8
mov dword [ebp - 0x490], 0
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x490]
test ecx, ecx
jne 0xbeb4be
mov esi, dword [0xd08c7c]
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x4bc], eax
cmp esi, 0xffffffff
je 0xb6ba9a
test esi, esi
je 0xb6b6bd
lea ecx, [ebp - 0x490]
push ecx
push 0xb28c80
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
js 0xb6b6bd
push 0x40
lea eax, [ebp - 0x584]
mov dword [ebp - 0x588], 0x44
push 0
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x4ec]
add esp, 0xc
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x560], 0xff000000
mov dword [ebp - 0x55c], 0xff000000
mov dword [ebp - 0x558], 0xa001
cmp eax, ecx
jl 0xbeb4dd
mov eax, dword [ebp - 0x4b8]
cmp ebx, eax
jl 0xbeb4f6
mov eax, dword [edi + 0x14]
mov ecx, dword [eax + 0x1c0]
test ecx, ecx
je 0xb6b478
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
cmp esi, fcn.00b6ff90
jne 0xbeb52e
mov eax, dword [ecx + 0x694]
mov ebx, 1
cmp dword [eax], 0
je 0xb6b470
mov dword [ebp - 0x4f0], 0
mov byte [ebp - 4], 3
mov eax, dword [ecx + 0x694]
mov ecx, dword [ebp - 0x4f0]
mov ebx, dword [eax]
test ecx, ecx
jne 0xbeb50f
mov esi, dword [ebx]
lea eax, [ebp - 0x4f0]
push eax
push 0
lea eax, [edi + 8]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
js 0xb6b459
mov eax, dword [ebp - 0x4f0]
test eax, eax
jne 0xb6b894
mov ebx, 1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4f0]
test ecx, ecx
jne 0xb6b8b2
test ebx, ebx
je 0xb6b961
mov eax, dword [edi + 0x14]
mov ecx, dword [eax + 0x1c0]
test ecx, ecx
je 0xb6b51c
mov eax, dword [ecx]
mov esi, dword [eax + 0x24]
cmp esi, fcn.00b6ff90
jne 0xbeb56c
mov eax, dword [ecx + 0x694]
mov ebx, 1
cmp dword [eax], 0
je 0xb6b514
mov dword [ebp - 0x4c0], 0
mov byte [ebp - 4], 4
mov eax, dword [ecx + 0x694]
mov ecx, dword [ebp - 0x4c0]
mov ebx, dword [eax]
test ecx, ecx
jne 0xbeb54d
mov esi, dword [ebx]
lea eax, [ebp - 0x4c0]
push eax
push 1
lea eax, [edi + 8]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
js 0xb6b4fd
mov eax, dword [ebp - 0x4c0]
test eax, eax
jne 0xb6b8d1
mov ebx, 1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c0]
test ecx, ecx
jne 0xb6b8ef
test ebx, ebx
je 0xb6b961
mov eax, dword [ebp - 0x4ac]
mov al, byte [eax + 0xf0]
cmp al, 0xff
jne 0xb6b878
mov eax, dword [ebp - 0x490]
lea edx, [ebp - 0x588]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp eax, 0x8000000a
je 0xb6baba
test byte [ebp - 0x550], 8
jne 0xb6b6bd
mov eax, dword [edi + 0x14]
xor ecx, ecx
mov dword [ebp - 0x4d0], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xb6b594
mov eax, dword [edx]
lea ecx, [ebp - 0x4d0]
push ecx
push edx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x4d0]
test cl, 0x10
jne 0xb6b6bd
mov eax, dword [edi + 0x14]
xor ecx, ecx
mov dword [ebp - 0x498], ecx
mov edx, dword [eax + 0x34]
test edx, edx
je 0xb6b5cc
mov eax, dword [edx]
lea ecx, [ebp - 0x498]
push ecx
push edx
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x498]
test ecx, 0x1000
jne 0xb6b6bd
mov ebx, dword [ebp - 0x4cc]
test ebx, ebx
jne 0xb6b7bb
mov ebx, dword [ebp - 0x4b4]
test ebx, ebx
jne 0xb6b7da
mov ebx, dword [edi + 0x18]
mov eax, dword [ebx]
mov esi, dword [eax + 0x80]
cmp esi, 0xb76270
jne 0xbeb5dc
mov eax, dword [ebx + 0x10]
xor esi, esi
mov dword [ebp - 0x484], esi
test eax, eax
jne 0xb6ba89
xor ecx, ecx
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x4c0], ecx
test eax, eax
jg 0xb6b979
mov ebx, dword [ebp - 0x4b4]
test esi, esi
jne 0xbeb5f4
mov dword [ebp - 0x4a0], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x4a0]
test ebx, ebx
jne 0xb6b7f6
test ecx, ecx
jne 0xbeb6ba
mov ebx, dword [edi + 0x18]
mov eax, dword [ebx]
mov esi, dword [eax + 0xa8]
cmp esi, 0xb76360
jne 0xbeb6ee
mov ecx, dword [ebx + 0x44]
test ecx, ecx
jne 0xbeb6d9
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x4a0], eax
xor eax, eax
mov ecx, dword [ebp + 4]
test eax, eax
js 0xbeb705
cmp dword [ebp - 0x4a0], 0
jne 0xbeb740
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4a0]
test ecx, ecx
jne 0xbeba2e
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x490]
test ecx, ecx
je 0xb6b6e8
mov dword [ebp - 0x490], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0x4c4]
mov eax, dword [ebp - 0x4c8]
add ebx, 4
sub eax, ebx
test eax, eax
jle 0xb6b70a
cmp dword [ebp - 0x4d8], 0
jne 0xbeba4d
mov esi, dword [ebp - 0x488]
mov ebx, dword [ebp - 0x4d4]
test ebx, ebx
jne 0xbebbfd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x70]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xb6b1a5
mov ecx, dword [edi + 0x18]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0x48]
cmp esi, fcn.00b761a0
jne 0xbeb3cd
call fcn.00b761a0
test eax, eax
jne 0xb6b1a5
mov eax, dword [ebp - 0x4a8]
mov esi, eax
mov dword [ebp - 0x490], esi
test eax, eax
jne 0xb6b1a7
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0x490], esi
jmp 0xb6b1a7
xor eax, eax
jmp 0xb6b10e
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 0x30]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, eax
test esi, esi
je 0xb6b5e6
jmp 0xbeb5fa
mov eax, dword [ebx]
mov esi, dword [eax + 0xb8]
cmp esi, fcn.00b77200
jne 0xbeb59a
mov esi, dword [ebx + 0x64]
jmp 0xb6b63a
test ecx, ecx
jne 0xbeb70c
mov eax, dword [ebx]
mov esi, dword [eax + 0xf4]
lea eax, [ebp - 0x4a0]
push eax
push ebx
cmp esi, fcn.00b4df40
je 0xb6b88d
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xb6b69e
jmp 0xbeb72b
mov eax, dword [esi]
push esi
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [ebp - 0x490]
mov dword [ebp - 0x49c], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ebp - 0x4a8]
jmp 0xb6b203
mov eax, dword [esi]
push esi
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x49c], eax
jmp 0xb6b233
or dword [ebp - 0x550], 8
movzx eax, al
mov dword [ebp - 0x54c], eax
jmp 0xb6b530
call fcn.00b4df40
jmp 0xb6b820
mov ecx, dword [eax]
lea edx, [ebp - 0x494]
push edx
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, eax
jmp 0xb6b45e
mov dword [ebp - 0x4f0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b470
mov ecx, dword [eax]
lea edx, [ebp - 0x494]
push edx
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, eax
jmp 0xb6b502
mov dword [ebp - 0x4c0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b514
mov dword [ebp - 0x4e4], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6a896
mov dword [ebp - 0x4e8], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6a954
push esi
push edx
add ecx, 0xffffffdc
call fcn.00b74cdb
mov edx, dword [ebp - 0x4a8]
jmp 0xb6b20c
mov eax, dword [ebp - 0x494]
or dword [ebp - 0x550], 8
mov dword [ebp - 0x54c], eax
jmp 0xb6b530
mov edi, dword [ebp - 0x498]
xor esi, esi
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x4d0], eax
test esi, esi
je 0xb6baf1
mov eax, dword [esi]
push esi
mov eax, dword [eax + 0xc0]
mov dword [ebp - 0x4bc], eax
cmp eax, fcn.00b771f0
jne 0xbeb5a7
call fcn.00b771f0
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0x498], eax
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0xc0]
mov dword [ebp - 0x4bc], eax
cmp eax, fcn.00b771f0
jne 0xbeb5ba
call fcn.00b771f0
mov ecx, dword [ebp - 0x4c0]
cmp dword [ebp - 0x498], eax
jb 0xb6baeb
inc ecx
mov dword [ebp - 0x4c0], ecx
cmp ecx, edi
jl 0xb6b981
mov edi, dword [ebp - 0x4b0]
test esi, esi
mov dword [ebp - 0x498], esi
mov esi, dword [ebp - 0x484]
je 0xb6b634
mov ecx, dword [ebp - 0x498]
push ecx
mov eax, dword [ecx]
mov esi, dword [eax + 0xb8]
cmp esi, fcn.00b77200
jne 0xbeb5cd
call fcn.00b77200
mov esi, eax
jmp 0xb6b634
cmp dword [ebp - 0x4d8], 0
jne 0xb6ae37
cmp dword [ebp - 0x494], 0
jle 0xb6ae37
mov esi, edx
sub esi, dword [eax + 0x10c]
sub esi, dword [eax + 0xfc]
sub esi, ecx
sub esi, ebx
cmp esi, dword [ebp - 0x494]
mov dword [ebp - 0x484], esi
mov esi, dword [ebp - 0x4dc]
jge 0xb6ae37
jmp 0xbeae9f
mov eax, dword [eax]
jmp 0xb6b61e
mov eax, ecx
cdq
idiv esi
jmp 0xb6adbb
mov edx, 0xb2b2ac
mov ecx, 0xd08c7c
call fcn.00b7ea9a
mov esi, dword [0xd08c7c]
mov eax, dword [ebp - 0x4bc]
jmp 0xb6b2fc
mov eax, dword [edi + 0x14]
mov edx, dword [edi + 0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov esi, dword [eax + 0x10]
lea eax, [ebp - 0x49c]
push eax
push 1
push 0
push edx
push ecx
cmp esi, fcn.00b75920
jne 0xbeb58b
call fcn.00b75920
jmp 0xb6b558
mov eax, dword [ebp - 0x4d0]
mov esi, eax
jmp 0xb6b9f4
xor eax, eax
jmp 0xb6a759
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6a7a1
mov dword [ebp - 0x4e4], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x4a4]
jmp 0xb6a845
push 0
push 0x10
push dword [ebp - 0x4cc]
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edx, eax
jmp 0xb6a89c
mov dword [ebp - 0x4e8], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x4a4]
jmp 0xb6a903
push 0
push 0x13
push dword [ebp - 0x4cc]
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edx, eax
jmp 0xb6a95a
mov eax, dword [ebx + 0x14]
lea edx, [edi + 0xc4]
mov ecx, esi
push dword [eax + 0x11c]
push 0xff0072ff
push 0xff
call fcn.00b5378c
mov ecx, dword [ebx + 0x14]
lea eax, [ebp - 0x484]
mov edx, dword [edi + 0x110]
push eax
movzx eax, byte [edi + 0x120]
push eax
lea eax, [ecx + 0x1c]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.00c7ddec
mov eax, dword [ebx + 0x14]
lea edx, [edi + 0xb4]
mov ecx, esi
push dword [eax + 0x11c]
push 0xff0072ff
push dword [ebp - 0x484]
call fcn.00b5378c
jmp 0xb6a9cd
mov eax, dword [edi]
cmp eax, 1
jne 0xbeabb8
cmp dword [ebp - 0x4b4], 0
jne 0xbeabc1
jmp 0xb6aa05
cmp eax, 3
jne 0xb6aa05
mov dword [ebp - 0x4d8], 1
jmp 0xb6aa0f
mov cl, 1
jmp 0xb6aa52
lea eax, [ebp - 0x504]
push eax
push 0
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6aa60
push 0xb2b82c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbeac18
push 0xb2b818
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xd08c24], esi
jmp 0xb6aa8c
mov esi, dword [0xd08c24]
jmp 0xb6aa8c
push 0
mov dword [0xd0a234], ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xbeac62
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xd08c28], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xd08c28]
jmp 0xb6aab7
mov ecx, 0x60
mov dword [0xd08c28], ecx
jmp 0xb6aab7
push 0xb2b82c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbeac9a
push 0xb2b818
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xd08c24], esi
jmp 0xb6aafb
mov esi, dword [0xd08c24]
jmp 0xb6aafb
push 0
mov dword [0xd0a234], ebx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xbeace4
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xd08c28], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xd08c28]
jmp 0xb6ab26
mov ecx, 0x60
mov dword [0xd08c28], ecx
jmp 0xb6ab26
mov eax, dword [ebp - 0x4a4]
cmp eax, 2
je 0xb6aba4
cmp eax, 1
je 0xbead11
cmp eax, 3
jne 0xb6abb0
lea eax, [ebp - 0x590]
mov edx, 4
push eax
xor cl, cl
call fcn.00b70e40
mov edx, dword [edi + 0x14c]
lea ecx, [ebp - 0x590]
push 2
call fcn.00b88bde
mov eax, dword [ebp - 0x590]
lea ebx, [eax + eax*4]
mov eax, dword [0xd0a1f4]
cmp ebx, eax
jg 0xbead4b
mov ebx, eax
sub ebx, esi
jmp 0xb6abb0
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xb6adc4
jmp 0xb6ac0c
mov cl, 1
jmp 0xb6ac8d
lea eax, [ebp - 0x510]
push eax
push 4
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6ac9e
push 0xb2b82c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbeadaf
push 0xb2b818
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xd08c24], esi
jmp 0xbeadb5
mov esi, dword [0xd08c24]
mov eax, 1
jmp 0xb6acca
push 0
mov dword [0xd0a234], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xbeadfd
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xd08c28], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xd08c28]
jmp 0xb6acf3
mov ecx, 0x60
mov dword [0xd08c28], ecx
jmp 0xb6acf3
push 0xb2b82c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbeae32
push 0xb2b818
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xd08c24], esi
jmp 0xbeae38
mov esi, dword [0xd08c24]
mov eax, 1
jmp 0xb6ad37
push 0
mov dword [0xd0a234], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xbeae80
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xd08c28], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xd08c28]
jmp 0xb6ad60
mov ecx, 0x60
mov dword [0xd08c28], ecx
jmp 0xb6ad60
mov dword [ebp - 0x494], 0
jmp 0xb6adc4
mov ecx, dword [ebp - 0x4ac]
imul ebx, dword [ebp - 0x494], 0x3e8
mov edi, dword [ebp - 0x494]
sub edi, dword [ebp - 0x484]
imul edi, dword [ecx + 0x11c]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ecx + 8]
mov esi, ebx
imul eax, edi
sub esi, edi
imul ecx, esi
add eax, ecx
mov ecx, dword [ebp - 0x4ac]
cdq
idiv ebx
mov dword [ebp - 0x4dc], eax
mov dword [ebp - 0x47c], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 4]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, dword [ebp - 0x4ac]
cdq
idiv ebx
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x480], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0xc]
imul eax, edi
imul ecx, esi
add eax, ecx
mov ecx, dword [ebp - 0x4ac]
cdq
idiv ebx
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x478], eax
mov eax, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x10]
imul eax, edi
imul ecx, esi
mov esi, dword [ebp - 0x4dc]
add eax, ecx
mov ecx, dword [ebp - 0x484]
cdq
idiv ebx
mov ebx, dword [ebp - 0x4a4]
mov edx, dword [ebp - 0x498]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x4d0]
jmp 0xb6ae37
cmp dword [ebp - 0x4d8], 0
je 0xb6aead
mov eax, dword [ebp - 0x4ac]
cmp dword [eax + 0xe4], 0
je 0xbeb013
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x494]
add eax, ebx
cmp eax, dword [ebp - 0x4c8]
jle 0xbeb013
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [edi + 0x14]
sub eax, ebx
mov ebx, dword [ebp - 0x494]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x4c8], eax
mov eax, dword [ecx + 0x64]
sub eax, dword [ecx + 0x74]
push eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov ecx, dword [esi + 0x68]
sub ecx, dword [esi + 0x78]
add eax, dword [esi + 0x74]
push ebx
push dword [ebp - 0x4c8]
mov dword [ebp - 0x490], eax
push ecx
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov ecx, dword [edi + 0x14]
mov ebx, eax
mov eax, dword [ebp - 0x474]
mov edx, dword [ebp - 0x478]
mov esi, dword [ebp - 0x47c]
add ebx, dword [ecx + 0x78]
mov ecx, dword [ebp - 0x480]
jmp 0xb6aec2
mov eax, dword [edi + 0x14]
mov ebx, dword [eax + 0x64]
mov dword [ebp - 0x490], ebx
mov ebx, dword [eax + 0x68]
jmp 0xb6aebc
mov cl, 1
jmp 0xb6af72
lea eax, [ebp - 0x4f8]
push eax
push 0
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6af80
push 0xb2b82c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbeb06c
push 0xb2b818
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xd08c24], esi
jmp 0xbeb072
mov esi, dword [0xd08c24]
mov eax, 1
jmp 0xb6afaf
push 0
mov dword [0xd0a234], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xbeb0ba
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xd08c28], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xd08c28]
jmp 0xb6afd8
mov ecx, 0x60
mov dword [0xd08c28], ecx
jmp 0xb6afd8
push 0xb2b82c
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0xbeb0ef
push 0xb2b818
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
mov dword [0xd08c24], esi
jmp 0xbeb0f5
mov esi, dword [0xd08c24]
mov eax, 1
jmp 0xb6b01c
push 0
mov dword [0xd0a234], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0xbeb13d
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push esi
mov dword [0xd08c28], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0xd08c28]
jmp 0xb6b045
mov ecx, 0x60
mov dword [0xd08c28], ecx
jmp 0xb6b045
push dword [ebp - 0x474]
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
push dword [ebp - 0x480]
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x4d4], eax
test eax, eax
je 0xbeb1c1
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
push dword [ebp - 0x488]
mov dword [ebp - 0x4dc], eax
call dword [sym.imp.GDI32.dll_GetClipRgn]
test eax, eax
jne 0xbeb1af
mov eax, dword [ebp - 0x4dc]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov dword [ebp - 0x4dc], eax
push dword [ebp - 0x4d4]
push dword [ebp - 0x488]
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov eax, dword [ebp - 0x4b8]
jmp 0xb6b08f
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x420]
push 0x104
push ecx
push dword [ebp - 0x4b4]
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x2c]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jns 0xbeb207
cmp eax, 0x8007007a
je 0xbeb207
mov esi, dword [ebp - 0x4c4]
jmp 0xbeb2b1
xor eax, eax
mov dword [ebp - 0x660], 0x40
lea edi, [ebp - 0x460]
stosd dword es:[edi], eax
push 0x3c
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x65c]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x65c], 0x2200
lea ecx, [ebp - 0x53c]
call fcn.00c97f49
mov edi, dword [ebp - 0x4b0]
mov edx, dword [ebp - 0x4e0]
mov ecx, dword [edi + 0x14]
mov ecx, dword [ecx + 0x38]
mov dword [ebp - 0x594], edx
lea edx, [ebp - 0x660]
push edx
lea edx, [ebp - 0x460]
push edx
push 0x8c24
push 0xffffffffffffffff
lea edx, [ebp - 0x420]
push edx
push eax
push 5
push dword [ebp - 0x488]
push ecx
call dword [sym.imp.UxTheme.dll_DrawThemeTextEx]
mov eax, dword [ebp - 0x458]
xor ecx, ecx
sub eax, dword [ebp - 0x460]
mov esi, dword [ebp - 0x4c4]
add eax, 4
add eax, esi
cmp eax, dword [ebp - 0x4c8]
setle cl
mov dword [ebp - 0x4d8], ecx
mov eax, dword [ebp - 0x4b8]
jmp 0xb6b09c
mov eax, dword [edi + 0x24]
test eax, eax
je 0xbeb2f8
mov eax, dword [eax]
cmp eax, 1
jle 0xbeb2d3
test byte [edi + 0x30], 0x10
je 0xbeb2ec
cmp eax, 1
je 0xbeb2ec
cmp eax, 1
jle 0xbeb2f8
test byte [edi + 0x30], 0x10
je 0xbeb2f8
mov dword [edi + 0x28], 3
jmp 0xb6b153
mov dword [edi + 0x28], 1
jmp 0xb6b153
mov eax, dword [edi + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x5c]
mov ecx, esi
call dword [0xd0cffc]
call esi
test al, 2
jne 0xbeb330
test byte [edi + 0x30], 0x20
jne 0xbeb330
mov ecx, edi
call fcn.00b983a1
test eax, eax
je 0xb6b153
mov dword [edi + 0x28], 2
jmp 0xb6b153
mov dword [edi + 0x28], 4
jmp 0xb6b153
mov esi, dword [ebp - 0x4a8]
mov dword [ebp - 0x490], esi
jmp 0xb6b1a7
mov eax, dword [edi + 0x24]
test eax, eax
je 0xbeb389
mov eax, dword [eax]
cmp eax, 1
jle 0xbeb364
test byte [edi + 0x30], 0x10
je 0xbeb37d
cmp eax, 1
je 0xbeb37d
cmp eax, 1
jle 0xbeb389
test byte [edi + 0x30], 0x10
je 0xbeb389
mov dword [edi + 0x28], 3
jmp 0xb6b19b
mov dword [edi + 0x28], 1
jmp 0xb6b19b
mov eax, dword [edi + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x5c]
mov ecx, esi
call dword [0xd0cffc]
call esi
test al, 2
jne 0xbeb3c1
test byte [edi + 0x30], 0x20
jne 0xbeb3c1
mov ecx, edi
call fcn.00b983a1
test eax, eax
je 0xb6b19b
mov dword [edi + 0x28], 2
jmp 0xb6b19b
mov dword [edi + 0x28], 4
jmp 0xb6b19b
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b771
lea ecx, [ebp - 0x49c]
push ecx
push esi
push edx
mov ecx, eax
call dword [0xd0cffc]
call dword [ebp - 0x484]
mov dword [ebp - 0x4bc], eax
test eax, eax
jns 0xbeb418
mov ecx, dword [ebp + 4]
mov edx, 0x226
push eax
push 0xb3019c
call fcn.00bc2921
mov eax, dword [ebp - 0x4bc]
jmp 0xbeb477
mov eax, dword [ebp - 0x49c]
jmp 0xb6b84c
lea ecx, [ebp - 0x49c]
push ecx
push esi
push edx
mov ecx, eax
call dword [0xd0cffc]
call dword [ebp - 0x4bc]
mov esi, eax
test esi, esi
jns 0xbeb47f
mov ecx, dword [ebp + 4]
mov edx, 0x233
push esi
push 0xb3019c
call fcn.00bc2921
mov eax, esi
jmp 0xbeb477
lea edi, [ebp - 0x49c]
push edi
push 0
push esi
push edx
push ecx
mov ecx, eax
call dword [0xd0cffc]
call dword [ebp - 0x4bc]
mov edi, dword [ebp - 0x4b0]
test eax, eax
js 0xb6b6e8
mov eax, dword [ebp - 0x49c]
jmp 0xb6b233
inc edx
add eax, 0xc
cmp edx, dword [ecx + 0x14]
jb 0xb6b2a4
mov eax, 0x80070490
jmp 0xb6b2ba
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp - 0x4e0]
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b2ba
mov dword [ebp - 0x490], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b2e1
or dword [ebp - 0x550], 8
push ecx
push eax
push 0xff
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
jmp 0xb6b882
or dword [ebp - 0x550], 8
push eax
push ebx
push 0xff
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
jmp 0xb6b882
mov dword [ebp - 0x4f0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b42a
lea eax, [ebp - 0x494]
push eax
push 0
lea eax, [edi + 8]
push eax
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, eax
jmp 0xb6b470
mov dword [ebp - 0x4c0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b4ce
lea eax, [ebp - 0x494]
push eax
push 1
lea eax, [edi + 8]
push eax
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, eax
jmp 0xb6b514
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b558
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xbeb5ed
mov ecx, eax
call dword [0xd0cffc]
call dword [ebp - 0x4bc]
jmp 0xb6b9b7
mov ecx, eax
call dword [0xd0cffc]
call dword [ebp - 0x4bc]
jmp 0xb6b9e2
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6ba39
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0x4b4]
mov esi, eax
jmp 0xb6b63a
mov ebx, dword [ebp - 0x4cc]
mov dword [ebp - 0x494], 0xff
test ebx, ebx
je 0xbeb638
lea eax, [ebp - 0x494]
push eax
mov eax, dword [edi + 0x14]
push 0x1e
push ebx
add eax, 0x1c
push eax
call fcn.00b67440
test eax, eax
je 0xbeb638
lea eax, [ebp - 0x494]
push eax
mov eax, dword [edi + 0x14]
push 0x1f
push ebx
add eax, 0x1c
push eax
call fcn.00b67440
lea eax, [ebp - 0x5dc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0xbeb6af
mov eax, dword [edi + 0x14]
push dword [eax + 0x14c]
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetricsForDpi]
push dword [ebp - 0x494]
mov ecx, dword [edi + 0x14]
mov edx, dword [ebp - 0x4c4]
push esi
push eax
mov ecx, dword [ecx + 0x110]
sub ecx, eax
push eax
mov eax, dword [ebp - 0x4b8]
add edx, ecx
add edx, dword [ebp - 0x480]
add eax, ecx
add eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0x488]
push eax
call fcn.00c7d8f3
push dword [ebp - 0x5cc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x5d0]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [ebp - 0x4b4]
jmp 0xb6b642
mov dword [ebp - 0x4a0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b666
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b688
lea eax, [ebp - 0x4a0]
mov ecx, esi
push eax
push ebx
call dword [0xd0cffc]
call esi
jmp 0xb6b693
mov edx, 0xd1a
jmp 0xbeb730
mov dword [ebp - 0x4a0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b7fe
mov edx, 0xd1f
push eax
push 0xb30294
call fcn.00b913f8
jmp 0xb6b69e
mov dword [ebp - 0x4a8], 0
lea eax, [ebp - 0x5c8]
mov byte [ebp - 4], 6
push eax
mov ecx, edi
call fcn.00c97e2d
mov ecx, dword [edi + 0x14]
lea eax, [ebp - 0x528]
push eax
lea edx, [ebp - 0x508]
mov ecx, dword [ecx + 0x114]
call fcn.00b5397c
lea ecx, [ebp - 0x4a8]
call fcn.00b8ba6f
fld dword [ebp - 0x528]
lea eax, [ebp - 0x4a8]
mov ecx, dword [ebp - 0x4a0]
lea edx, [ebp - 0x5c8]
push eax
sub esp, 0xc
fstp dword [esp + 4]
fld dword [ebp - 0x508]
fstp dword [esp]
call fcn.00c8a6ee
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xbeb7c9
push eax
push 0xb30294
mov edx, 0xd2a
call fcn.00b913f8
jmp 0xbeb832
mov eax, dword [edi + 0x14]
mov ebx, dword [ebp - 0x4b0]
mov edx, dword [eax + 0x14c]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebx + 0x18]
mov edi, dword [eax]
lea eax, [ebp - 0x4a4]
push eax
mov eax, dword [ecx]
push edx
push dword [ebp - 0x4a8]
mov esi, dword [eax + 0x4c]
push ecx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [edi + 0x50]
mov ecx, esi
push eax
mov eax, dword [ebx + 0x14]
push dword [eax + 0x30]
call dword [0xd0cffc]
call esi
cmp eax, 0x8000000a
je 0xbeb830
mov ecx, dword [ebp + 4]
test eax, eax
jns 0xbeb846
push eax
push 0xb30294
mov edx, 0xd2f
call fcn.00b913f8
mov edi, ebx
lea ecx, [ebp - 0x4a8]
mov byte [ebp - 4], 5
call fcn.00b8ba6f
jmp 0xb6b6ab
lea eax, [ebp - 0x5bc]
push eax
push 0x18
push dword [ebp - 0x4a4]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0xbeb830
mov edi, ebx
mov ecx, 4
push 0
mov eax, dword [edi + 0x14]
mov edx, dword [eax + 0x14c]
call fcn.00b625f3
cmp dword [ebp - 0x4d8], 0
mov edx, eax
mov ebx, dword [ebp - 0x5b8]
mov ecx, dword [ebp - 0x5b4]
mov dword [ebp - 0x508], edx
mov dword [ebp - 0x430], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ecx
je 0xbeb91a
mov eax, dword [edi + 0x14]
mov ecx, 4
push 0
mov edx, dword [eax + 0x14c]
call fcn.00b625f3
mov esi, dword [ebp - 0x4ac]
cdq
sub eax, edx
mov edx, dword [ebp - 0x428]
sar eax, 1
sub eax, dword [ebp - 0x5b8]
add eax, dword [ebp - 0x4f8]
add eax, dword [ebp - 0x480]
mov esi, dword [esi + 0x10]
mov ecx, eax
sub esi, dword [ebp - 0x5b4]
sub ecx, dword [ebp - 0x430]
sub esi, dword [ebp - 0x508]
add edx, ecx
mov dword [ebp - 0x430], eax
mov eax, esi
sub eax, dword [ebp - 0x42c]
add dword [ebp - 0x424], eax
jmp 0xbeb955
mov eax, dword [ebp - 0x4ac]
mov esi, dword [eax + 0x10]
mov eax, ebx
sub esi, ecx
mov ecx, dword [ebp - 0x4f8]
sub esi, edx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, dword [ebp - 0x480]
add eax, ecx
mov dword [ebp - 0x430], eax
lea edx, [eax + ebx]
mov eax, dword [ebp - 0x5b4]
add eax, esi
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], edx
mov eax, dword [eax + 0xc]
cmp edx, eax
jle 0xbeb980
sub eax, edx
push 0
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_OffsetRect]
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov dword [ebp - 0x524], ebx
mov byte [ebp - 4], 7
test ebx, ebx
je 0xbeba0c
push dword [ebp - 0x4a4]
mov dword [ebp - 0x59c], ebx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
mov dword [ebp - 0x598], edi
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x424]
mov esi, dword [ebp - 0x42c]
sub edx, esi
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x430]
sub eax, ecx
mov dword [ebp - 0x4b8], 0x1ff0000
push dword [ebp - 0x4b8]
push edx
push eax
push 0
push 0
push ebx
push edx
push eax
push esi
push ecx
push dword [ebp - 0x488]
call dword [sym.imp.GDI32.dll_GdiAlphaBlend]
push edi
push ebx
mov byte [ebp - 4], 7
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [ebp - 0x4b0]
mov byte [ebp - 4], 6
mov dword [ebp - 0x524], 0
test ebx, ebx
je 0xbeb832
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0xbeb832
mov dword [ebp - 0x4a0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb6b6bd
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x4b4]
add eax, 0x1c
push 0
push 0x13
push esi
push eax
call fcn.00b67440
test eax, eax
je 0xb6b70a
mov eax, dword [edi + 0x14]
push 0
push 0x15
push esi
add eax, 0x1c
push eax
call fcn.00b67440
test eax, eax
je 0xb6b70a
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x218]
push 0x104
push ecx
push dword [ebp - 0x4b4]
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x2c]
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jns 0xbebab9
cmp eax, 0x8007007a
jne 0xb6b70a
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.api_ms_win_ntuser_rectangle_l1_1_0.dll_CopyRect]
mov eax, dword [ebp - 0x440]
add eax, ebx
mov dword [ebp - 0x620], 0x40
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x434]
push 0x3c
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x61c]
push 0
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x61c], 0x2200
lea ecx, [ebp - 0x53c]
call fcn.00c97f49
mov ecx, dword [edi + 0x14]
mov esi, eax
mov ebx, dword [ebp - 0x4e0]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x450]
mov ecx, dword [ecx + 0x38]
push eax
push 0xc24
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
mov dword [ebp - 0x5a0], ebx
push eax
push esi
push 5
push dword [ebp - 0x488]
push ecx
call dword [sym.imp.UxTheme.dll_DrawThemeTextEx]
mov eax, dword [edi + 0x14]
lea ecx, [ebp - 0x620]
and dword [ebp - 0x61c], 0xfffffdff
push ecx
lea ecx, [ebp - 0x440]
mov eax, dword [eax + 0x38]
push ecx
push 0x8824
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x5a4], ebx
push ecx
push esi
mov esi, dword [ebp - 0x488]
push 5
push esi
push eax
call dword [sym.imp.UxTheme.dll_DrawThemeTextEx]
mov ebx, dword [ebp - 0x4cc]
test ebx, ebx
je 0xb6b710
mov edx, dword [ebp - 0x448]
xor ecx, ecx
mov eax, dword [ebp - 0x438]
sub edx, dword [ebp - 0x450]
sub eax, dword [ebp - 0x440]
mov esi, dword [ebx]
cmp edx, eax
setg cl
push ecx
mov esi, dword [esi + 0x14]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xb6b70a
mov edi, dword [ebp - 0x4dc]
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectClipRgn]
test edi, edi
je 0xbebc16
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0xb6b71e