Function at 0x48e470
Capabilities:
Capture screenshot
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6dc
mov ecx, dword [0x51ae08]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x12c], ecx
cmp ecx, esi
je 0x48e497
call fcn.0041acb0
mov edi, dword [ebp + 8]
mov al, 1
cmp al, byte [edi + 2]
sbb ecx, ecx
and ecx, dword [0x51ae0c]
mov dword [esp + 0x128], ecx
je 0x48e4b5
call fcn.0041acb0
mov ecx, 2
cmp cl, byte [edi + 2]
sbb ecx, ecx
and ecx, dword [0x51ae10]
mov dword [esp + 0xf0], ecx
je 0x48e4d3
call fcn.0041acb0
mov edx, dword [0x5165ec]
movzx edi, word [edx + 0xf0]
xor ebx, ebx
and edi, 3
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], esi
cmp edi, 2
je 0x48e56d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0xa0], eax
cmp eax, esi
je 0x48e56d
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x48e56d
mov edx, dword [esp + 0xa0]
cmp edi, esi
jne 0x48e530
lea ecx, [esp + 0xf8]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x48e54d
lea ecx, [esp + 0xf8]
push ecx
push edx
mov dword [esp + 0x100], esi
mov dword [esp + 0x104], esi
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x48e56d
add ebx, dword [esp + 0xf8]
mov eax, dword [esp + 0xfc]
add dword [esp + 0xd0], eax
mov dword [esp + 0xcc], ebx
or eax, 0xffffffff
mov dword [esp + 0x64], eax
mov dword [esp + 0xa4], eax
mov eax, 3
mov dword [esp + 0x68], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xc8], esi
mov dword [esp + 0xdc], esi
mov dword [esp + 0xac], esi
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0xf4], esi
mov dword [esp + 0xec], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0x8c], esi
mov esi, dword [ebp + 0x1c]
mov byte [esp + 0x19], 0
mov byte [esp + 0x59], 0
mov byte [esp + 0xd], 0
mov byte [esp + 0x1e], 0
mov byte [esp + 0x45], 1
mov dword [esp + 0x50], eax
mov dword [esp + 0xb0], eax
mov byte [esp + 0x5b], 0
mov byte [esp + 0xf], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x1a], 0
mov byte [esp + 0x1c], 0
mov byte [esp + 0x77], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x4f], 0
mov byte [esp + 0x1f], 0
mov byte [esp + 0x29], 1
mov byte [esp + 0x18], 0
mov byte [esp + 0xe], 0
movzx eax, word [esi]
cmp eax, 0x20
je 0x48e663
cmp eax, 9
jne 0x48e668
add esi, 2
jmp 0x48e656
cmp word [esi], 0x2a
jne 0x48f067
mov ebx, 1
jmp 0x48e684
mov esi, dword [esp + 0x34]
mov edi, 2
movzx ecx, word [esi + edi]
add esi, edi
push ecx
call fcn.004cb3ba
add eax, 0xffffffba
add esp, 4
cmp eax, 0x11
ja case.0x48e6ab.71
movzx edx, byte [eax + 0x4907bc]
jmp dword [edx*4 + 0x490790]
push 0xa
push 0x50d450
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e6dc
add esi, 0x14
mov byte [esp + 0x18], 1
jmp 0x48eb88
push 0xa
push 0x50d478
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e70b
add esi, 0x14
mov byte [esp + 0x18], 1
mov byte [esp + 0xe], 1
jmp 0x48eb88
push 3
push 0x50d668
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
movzx eax, word [esi + 6]
add esi, 6
mov byte [esp + 0x77], 1
cmp eax, 0x57
jne 0x48e74a
cmp word [esi + 2], 0x48
jne 0x48e74a
mov byte [esp + 0x4f], 1
mov byte [esp + 0x46], 1
jmp 0x48eb88
cmp eax, 0x48
jne 0x48e765
cmp word [esi + 2], 0x57
jne 0x48e765
mov byte [esp + 0x4f], 1
mov byte [esp + 0x46], 1
jmp 0x48eb88
cmp eax, 0x57
jne 0x48e774
mov byte [esp + 0x46], 1
jmp 0x48eb88
cmp eax, 0x48
jne 0x48e821
mov byte [esp + 0x4f], 1
jmp 0x48eb88
push 0xa
push 0x50d3c4
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e7b5
add esi, 0x14
mov byte [esp + 0x1e], 1
mov byte [esp + 0x45], al
jmp 0x48eb88
push 4
push 0x50d3ec
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
add esi, 8
mov byte [esp + 0x1e], 1
jmp 0x48eb88
push 7
push 0x50d670
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
lea eax, [esp + 0xc0]
add esi, 0xe
push eax
mov ecx, esi
call fcn.00498710
add esp, 4
test al, al
jne 0x48eb88
mov byte [esp + 0xd], 1
jmp 0x48eb88
push 3
push 0x50d690
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
add esi, 6
mov byte [esp + 0x5b], 1
jmp 0x48eb88
push 6
push str.Result
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
push 6
push 0x50d4c0
add esi, 0xc
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e89d
mov dword [esp + 0xb0], ebx
jmp 0x48eb88
push 6
push str.CENTER
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e8bd
mov dword [esp + 0xb0], edi
jmp 0x48eb88
push edi
push 0x50d4f0
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e99b
push edi
push 0x50d4f8
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e99b
push edi
push 0x50d500
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e98b
push edi
push 0x50d508
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e98b
push edi
push 0x50d510
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e97b
push edi
push 0x50d518
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e97b
push edi
push 0x50d520
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e96b
push edi
push 0x50d528
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
je 0x48e96b
mov byte [esp + 0xd], 1
jmp 0x48eb88
mov dword [esp + 0xb0], 6
jmp 0x48eb88
mov dword [esp + 0xb0], 5
jmp 0x48eb88
mov dword [esp + 0xb0], 4
jmp 0x48eb88
mov dword [esp + 0xb0], 3
jmp 0x48eb88
push 4
push 0x50d530
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eac7
push edi
add esi, 8
push 0x50d4f0
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e9eb
mov dword [esp + 0x50], ebx
jmp 0x48eb88
push edi
push 0x50d4f8
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ea0b
mov dword [esp + 0x50], 7
jmp 0x48eb88
push edi
push 0x50d528
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ea2b
mov dword [esp + 0x50], 5
jmp 0x48eb88
push edi
push 0x50d510
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ea47
mov dword [esp + 0x50], edi
jmp 0x48eb88
push edi
push 0x50d518
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ea67
mov dword [esp + 0x50], 8
jmp 0x48eb88
push edi
push 0x50d500
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ea83
mov dword [esp + 0x50], eax
jmp 0x48eb88
push edi
push 0x50d508
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eaa3
mov dword [esp + 0x50], 6
jmp 0x48eb88
push edi
push 0x50d520
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e821
mov dword [esp + 0x50], 3
jmp 0x48eb88
push 6
push str.Select
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
add esi, 0xc
mov ebx, 0x4ebd9c
mov eax, esi
mov dword [esp + 0x34], esi
call fcn.00409d30
cmp esi, eax
je 0x48eb83
push 0xc7
lea ecx, [esp + 0x14c]
push esi
push ecx
call fcn.004cb3f1
xor edx, edx
add esp, 0xc
lea eax, [esp + 0x148]
mov word [esp + 0x2d6], dx
call fcn.00409d30
test eax, eax
je 0x48eb2f
xor ecx, ecx
mov word [eax], cx
lea esi, [esp + 0x148]
call fcn.0041ac40
mov dword [esp + 0x30], eax
test eax, eax
jns 0x48eb4b
mov dword [esp + 0x30], 0
mov ebx, 0x4ec87c
lea eax, [esp + 0x148]
call fcn.00409d30
test eax, eax
je 0x48eb7f
lea edx, [esp + 0x60]
lea ecx, [eax + 2]
push edx
call fcn.00498710
add esp, 4
cmp dword [esp + 0x60], 0
jge 0x48eb7f
mov dword [esp + 0x60], 0
mov esi, dword [esp + 0x34]
mov ebx, 1
test esi, esi
je 0x48ebd1
movzx eax, word [esi]
test ax, ax
je 0x48ebd1
jmp 0x48eba0
movzx edx, ax
mov ecx, 0x4ebd9c
mov eax, 0x20
lea ecx, [ecx]
cmp dx, ax
je 0x48f039
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x48ebb0
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x48eba0
cmp byte [esp + 0x29], 0
je 0x48ebea
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x48ebea
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp byte [esp + 0x1e], 0
je 0x48ebf8
cmp byte [esp + 0x45], 0
je 0x48ec06
mov edx, dword [esp + 0x84]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x5165ec]
test byte [eax + 0x100], 1
jne 0x490772
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4ebe14
push ecx
call fcn.004aefb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 8
push 0x50d54c
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ec61
add esi, 0x10
lea edi, [esp + 0xa4]
jmp 0x48ec85
push 5
push 0x50d360
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ec9e
add esi, 0xa
lea edi, [esp + 0x64]
mov ecx, esi
call fcn.00498780
test al, al
jne 0x48eb88
mov byte [esp + 0xd], 1
jmp 0x48eb88
push 6
push 0x50d570
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
push 0xa
push 0x50d3c4
add esi, 0xc
mov byte [esp + 0x27], 1
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ecf2
add esi, 0x14
mov byte [esp + 0x17], 1
mov byte [esp + 0x29], al
jmp 0x48ed43
push 4
push 0x50d3ec
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48ed16
mov byte [esp + 0x17], 1
jmp 0x48ed3b
push 4
push 0x4f1444
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48e821
mov byte [esp + 0x17], al
add esi, 8
mov byte [esp + 0x29], 1
cmp byte [esp + 0xd], 0
mov dword [esp + 0x34], esi
jne 0x48eb88
cmp dword [esp + 0x8c], 0
jne 0x48eb88
push 0x207
lea eax, [esp + 0x2dc]
push esi
push eax
call fcn.004cb3f1
xor ecx, ecx
add esp, 0xc
mov ebx, 0x4ebd9c
lea eax, [esp + 0x2d8]
mov word [esp + 0x6e6], cx
call fcn.00409d30
test eax, eax
je 0x48ed9a
xor edx, edx
mov word [eax], dx
cmp byte [esp + 0x17], 0
je 0x48edb9
lea esi, [esp + 0x2d8]
call fcn.0041ac40
mov dword [esp + 0x8c], eax
jmp 0x48ee4c
push 0x207
lea eax, [esp + 0x2dc]
push esi
push eax
call fcn.004cb3f1
xor ecx, ecx
add esp, 0xc
cmp word [esp + 0x2d8], 0x3c
mov word [esp + 0x6e6], cx
jne 0x48ee5e
mov ebx, 0x50d408
lea eax, [esp + 0x2da]
call fcn.00409d30
test eax, eax
je 0x48ee5e
xor edx, edx
mov word [eax], dx
push 0
lea ecx, [esp + 0x2dc]
sub eax, ecx
push 0
sar eax, 1
lea edx, [esi + eax*2 + 2]
push 0
lea eax, [esp + 0x104]
push eax
push 0
lea ecx, [esp + 0x2ee]
push 0
push ecx
mov dword [esp + 0x50], edx
call fcn.004ad690
mov dword [esp + 0xa8], eax
mov eax, 1
add esp, 0x1c
cmp dword [esp + 0xf8], eax
jne 0x48ee4c
mov byte [esp + 0xd], al
cmp dword [esp + 0x8c], 0
jne 0x48eb7f
mov esi, dword [esp + 0x34]
mov byte [esp + 0xd], 1
jmp 0x48eb83
push 0xc
push 0x50d6b8
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
add esi, 0x18
mov byte [esp + 0x59], 1
jmp 0x48eb88
push 5
push 0x50d6e4
call fcn.004a4b10
add esp, 4
push eax
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
add esi, 0xa
lea ebx, [ebx]
movzx eax, word [esi]
cmp eax, 0x57
jne 0x48eed6
mov byte [esp + 0x1d], 1
mov byte [esp + 0xf], 1
add esi, edi
jmp 0x48eec0
cmp eax, 0x48
jne 0x48eee9
mov byte [esp + 0x1a], 1
mov byte [esp + 0xf], 1
add esi, edi
jmp 0x48eec0
cmp eax, 0x4c
jne 0x48eefe
mov dword [esp + 0xe8], ebx
mov byte [esp + 0x1c], 1
add esi, edi
jmp 0x48eec0
cmp eax, 0x54
jne 0x48ef13
mov dword [esp + 0xe4], ebx
mov byte [esp + 0x1c], 1
add esi, edi
jmp 0x48eec0
cmp eax, 0x52
jne 0x48ef28
mov dword [esp + 0xf4], ebx
mov byte [esp + 0x1c], 1
add esi, edi
jmp 0x48eec0
cmp eax, 0x42
jne 0x48ef3d
mov dword [esp + 0xec], ebx
mov byte [esp + 0x1c], 1
add esi, edi
jmp 0x48eec0
cmp eax, 0x20
je 0x48eb88
cmp eax, 9
je 0x48eb88
mov byte [esp + 0xd], 1
add esi, edi
jmp 0x48eec0
mov edx, dword [0x51e6d4]
push edi
push edx
push esi
call fcn.004ca3fb
add esp, 0xc
test eax, eax
jne 0x48eb88
add esi, 4
cmp dword [ebp + 0x14], eax
jle 0x48ef82
mov eax, dword [ebp + 0xc]
dec eax
jmp 0x48ef84
xor eax, eax
add dword [ebp + 0x14], eax
cmp dword [ebp + 0x18], 0
jle 0x48ef99
mov eax, dword [ebp + 0x10]
dec eax
add dword [ebp + 0x18], eax
jmp 0x48eb88
xor eax, eax
add dword [ebp + 0x18], eax
jmp 0x48eb88
mov eax, esi
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x48efb2
cmp ecx, 9
jne 0x48efb6
add eax, edi
jmp 0x48efa5
movzx ecx, word [eax]
test cx, cx
je 0x48f003
cmp ecx, 0x2d
je 0x48efc8
cmp ecx, 0x2b
jne 0x48efcb
add eax, 2
cmp word [eax], 0x30
jne 0x48f003
movzx ecx, word [eax + 2]
cmp ecx, 0x78
je 0x48efdf
cmp ecx, 0x58
jne 0x48f003
movzx eax, word [eax + 4]
push eax
call fcn.004cb07e
add esp, 4
test eax, eax
je 0x48f003
push 0x10
push 0
push esi
call fcn.004cb270
add esp, 0xc
mov dword [esp + 0x68], eax
jmp 0x48f010
push esi
call fcn.004cae86
add esp, 4
mov dword [esp + 0x68], eax
test eax, eax
jns 0x48f021
mov dword [esp + 0x68], 0
jmp 0x48eb88
cmp eax, 0xff
jle 0x48eb88
mov dword [esp + 0x68], 0xff
jmp 0x48eb88
lea eax, [esi + 2]
mov dword [ebp + 0x1c], eax
nop
movzx ecx, word [eax]
cmp ecx, 0x20
je 0x48f04d
cmp ecx, 9
jne 0x48f052
add eax, 2
jmp 0x48f040
cmp word [eax], 0x2a
mov dword [esp + 0x34], eax
je 0x48e680
cmp byte [esp + 0x1f], 0
jne 0x48f08c
mov ebx, dword [ebp + 0xc]
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0xd0]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
add dword [ebp + 0x10], ecx
add ebx, eax
add esi, eax
mov dword [ebp + 0xc], ebx
add edi, ecx
jmp 0x48f095
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
xor ecx, ecx
or eax, 0xffffffff
mov dword [esp + 0x88], ecx
cmp dword [esp + 0x64], eax
jne 0x48f0b2
mov dword [esp + 0xa4], eax
mov byte [esp + 0xf], cl
cmp byte [esp + 0x59], cl
jne 0x48f0c2
dec dword [esp + 0x30]
jns 0x48f0c2
mov dword [esp + 0x30], ecx
cmp byte [esp + 0xf], cl
jne 0x48f0cc
mov byte [esp + 0x1c], cl
cmp byte [esp + 0x1e], cl
je 0x48f0fe
mov eax, dword [ebp + 0x1c]
call fcn.0040e320
test al, al
je 0x48f0f0
mov ecx, dword [ebp + 0x1c]
push 0x10
push 0
push ecx
call fcn.004cb90a
add esp, 0xc
jmp 0x48f11c
mov edx, dword [ebp + 0x1c]
push edx
call fcn.004cae91
add esp, 4
jmp 0x48f11c
mov ecx, dword [ebp + 0x1c]
push 0
push 0
push 0
lea eax, [esp + 0x94]
push eax
push 0
push 0
push ecx
call fcn.004ad690
add esp, 0x1c
mov dword [esp + 0x84], eax
test eax, eax
je 0x48ebd1
cmp dword [esp + 0x88], 1
je 0x48ebd1
cmp byte [esp + 0xd], 0
jne 0x48ebd1
cmp byte [esp + 0x1f], 0
push 0
je 0x48f155
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x48f15b
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0xa8], eax
test eax, eax
jne 0x48f194
cmp byte [esp + 0x1e], al
je 0x48f176
cmp byte [esp + 0x45], al
je 0x48ebd1
mov edx, dword [esp + 0x84]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x84], 0
jmp 0x48ebd1
xor eax, eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0xf8], eax
mov byte [esp + 0xd], al
push 8
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0xe8]
push ecx
lea edx, [esp + 0xa0]
push edx
push eax
mov eax, dword [esp + 0xbc]
call fcn.00438da0
add esp, 0x14
mov dword [esp + 0xa0], eax
test eax, eax
je 0x4904c8
cmp byte [esp + 0x1f], 0
jne 0x48f3bf
sub edi, dword [ebp + 0x10]
mov ecx, dword [esp + 0xa8]
sub esi, ebx
inc edi
push ecx
inc esi
mov dword [esp + 0x8c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
mov dword [esp + 0xd4], edi
test edi, edi
je 0x48f2b8
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0xa8]
push edx
push esi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0xc4], eax
test eax, eax
je 0x48f2b8
mov ecx, eax
push ecx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0xf8], eax
test eax, eax
je 0x48f2b8
mov edx, dword [ebp + 0x10]
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x88]
push 0xcc0020
push edx
push ebx
push eax
push ecx
push esi
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x48f2b8
push 8
lea edx, [esp + 0x1f]
push edx
mov edx, dword [esp + 0xcc]
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x4c]
push ecx
push edx
mov eax, edi
call fcn.00438da0
add esp, 0x14
mov dword [esp + 0x5c], eax
test eax, eax
jne 0x48f4ac
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esp + 0x29], 0
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x48f2e7
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x48f2e7
push eax
call esi
cmp byte [esp + 0x1e], 0
je 0x48f2f5
cmp byte [esp + 0x45], 0
je 0x48f2ff
mov ecx, dword [esp + 0x84]
push ecx
call esi
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x48f30d
push eax
call esi
mov esi, dword [esp + 0xd4]
test esi, esi
je 0x48f332
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x48f32b
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0xac]
test eax, eax
je 0x48f346
push eax
call fcn.004ca991
add esp, 4
mov eax, dword [esp + 0xb8]
test eax, eax
je 0x48f35a
push eax
call fcn.004ca991
add esp, 4
mov eax, dword [esp + 0xc8]
test eax, eax
je 0x48f36e
push eax
call fcn.004ca991
add esp, 4
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x48f382
push eax
call fcn.004ca991
add esp, 4
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x48f393
push eax
call fcn.004ca991
add esp, 4
cmp dword [esp + 0xc0], 0
jne 0x4904ea
mov eax, dword [0x51b6d0]
push 0x18
push 0
push 3
call fcn.00401590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0xd4], eax
test eax, eax
je 0x4904c8
test ebx, ebx
jne 0x48f405
cmp dword [ebp + 0x10], ebx
jne 0x48f405
test esi, esi
jne 0x48f405
test edi, edi
jne 0x48f405
push 8
lea eax, [esp + 0x1f]
push eax
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x4c]
push edx
push eax
jmp 0x48f491
mov edx, dword [esp + 0x8c]
lea ecx, [esp + 0x130]
push ecx
push 0x18
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x4904c8
test esi, esi
jne 0x48f441
test edi, edi
jne 0x48f441
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x138]
dec eax
dec ecx
mov edi, ecx
mov esi, eax
mov eax, dword [ebp + 0x10]
mov edx, dword [esp + 0x8c]
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push eax
sub edi, eax
push ebx
inc edi
push edi
sub esi, ebx
inc esi
push esi
push edx
lea eax, [esp + 0xec]
push eax
call fcn.0049b5e0
add esp, 0x2c
test al, al
je 0x4904c8
push 8
lea ecx, [esp + 0x1f]
push ecx
mov ecx, dword [esp + 0xcc]
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x4c]
push eax
push ecx
mov eax, dword [esp + 0xe8]
call fcn.00438da0
add esp, 0x14
mov dword [esp + 0x5c], eax
test eax, eax
je 0x4904c8
mov esi, dword [esp + 0x94]
mov ebx, dword [esp + 0xe0]
mov edi, dword [esp + 0x40]
imul edi, dword [esp + 0x70]
mov ecx, dword [esp + 0xc0]
mov eax, esi
imul eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x80], edi
test ecx, ecx
jne 0x48f4fc
mov eax, ebx
cdq
idiv esi
test edx, edx
jne 0x4904bd
mov ecx, eax
mov dword [esp + 0xc0], ecx
test ecx, ecx
je 0x4904c8
mov eax, ebx
cdq
idiv ecx
mov edx, esi
mov dword [esp + 0x20], esi
imul edx, eax
mov dword [esp + 0x3c], edx
imul edx, ecx
mov dword [esp + 0x38], eax
cmp dword [esp + 0x2c], edx
jne 0x4904bd
mov edx, dword [esp + 0x30]
cmp edx, ecx
jge 0x4904c8
xor ebx, ebx
cmp dword [esp + 0x60], ebx
jne 0x48f53b
mov eax, ecx
sub eax, edx
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x60]
add eax, edx
cmp eax, ecx
jg 0x4904c8
dec eax
mov dword [esp + 0x10c], eax
cmp byte [esp + 0xf], bl
je 0x48f582
mov ecx, dword [esp + 0x38]
add ecx, 2
lea eax, [esi + 2]
imul eax, ecx
lea edx, [eax*4]
push edx
mov dword [esp + 0xe0], eax
call fcn.004c9c38
add esp, 4
mov dword [esp + 0xac], eax
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xe0], ecx
mov dword [esp + 0x88], edx
mov dword [esp + 0x108], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xb4], ebx
mov byte [esp + 0x47], bl
mov byte [esp + 0x5a], bl
cmp byte [esp + 0x18], bl
je 0x48f7ff
xor esi, esi
cmp edi, ebx
mov bl, byte [esp + 0xe]
mov byte [esp + 0x47], 1
jle 0x48f64f
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + esi*4]
mov edx, eax
shr edx, 8
movzx ecx, dl
mov edx, eax
shr edx, 0x10
movzx eax, al
movzx edx, dl
add ecx, edx
add ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
test bl, bl
je 0x48f637
mov ecx, 0xff
sub ecx, dword [esp + 0x68]
cmp eax, ecx
mov eax, dword [esp + 0x5c]
sbb edx, edx
and edx, 0xff000001
add edx, 0xffffff
mov dword [eax + esi*4], edx
jmp 0x48f64a
mov edx, dword [esp + 0x5c]
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
mov dword [edx + esi*4], ecx
inc esi
cmp esi, edi
jl 0x48f5e5
cmp dword [esp + 0x64], 0xffffffff
mov byte [esp + 0x5a], 1
je 0x48f6f6
xor ebx, ebx
cmp dword [esp + 0x2c], ebx
jle 0x48f783
mov esi, dword [esp + 0xa0]
mov eax, dword [esi + ebx*4]
and eax, 0xffffff
cmp eax, dword [esp + 0x64]
jne 0x48f685
mov dword [esi + ebx*4], eax
jmp 0x48f6ea
mov edi, dword [esp + 0x80]
mov ecx, eax
mov edx, eax
shr ecx, 8
shr edx, 0x10
movzx ecx, cl
movzx edx, dl
movzx eax, al
add ecx, edx
add ecx, eax
mov eax, 0x55555556
imul ecx
cmp byte [esp + 0xe], 0
je 0x48f6d4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, 0xff
sub edx, dword [esp + 0x68]
cmp ecx, edx
sbb eax, eax
and eax, 0xff000001
add eax, 0xffffff
mov dword [esi + ebx*4], eax
jmp 0x48f6ea
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
mov dword [esi + ebx*4], ecx
inc ebx
cmp ebx, dword [esp + 0x2c]
jl 0x48f672
jmp 0x48f783
cmp dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0
jle 0x48f77f
mov edi, dword [esp + 0xa0]
lea esp, [esp]
mov esi, dword [esp + 0x10]
mov eax, dword [edi + esi*4]
mov edx, eax
shr edx, 8
movzx ecx, dl
mov edx, eax
shr edx, 0x10
movzx eax, al
movzx edx, dl
add ecx, edx
add ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
test bl, bl
je 0x48f75e
mov ecx, 0xff
sub ecx, dword [esp + 0x68]
cmp eax, ecx
sbb edx, edx
and edx, 0xff000001
add edx, 0xffffff
mov dword [edi + esi*4], edx
jmp 0x48f76d
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
mov dword [edi + esi*4], ecx
inc esi
mov dword [esp + 0x10], esi
cmp esi, dword [esp + 0x2c]
jl 0x48f710
mov edi, dword [esp + 0x80]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
cmp eax, 0xffffffff
je 0x48f7d9
mov edx, eax
shr edx, 8
movzx ecx, dl
mov edx, eax
shr edx, 0x10
movzx eax, al
movzx edx, dl
add ecx, edx
add ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp byte [esp + 0xe], 0
je 0x48f7ea
mov ecx, 0xff
sub ecx, dword [esp + 0x68]
cmp eax, ecx
sbb eax, eax
and eax, 0xff000001
add eax, 0xffffff
mov dword [esp + 0xa4], eax
cmp byte [esp + 0xe], 0
je 0x48f803
mov dword [esp + 0x68], 0
jmp 0x48f803
mov ecx, eax
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, eax
mov dword [esp + 0xa4], ecx
jmp 0x48f803
mov ebx, dword [esp + 0x10]
cmp dword [esp + 0x50], 3
je 0x48f91b
cmp byte [esp + 0xf], 0
mov eax, dword [esp + 0xdc]
jne 0x48f820
mov eax, dword [esp + 0x3c]
lea edx, [eax*4]
push edx
call fcn.004c9c38
xor esi, esi
add esp, 4
mov dword [esp + 0xb8], eax
cmp eax, esi
je 0x4904cc
lea eax, [edi*4]
push eax
call fcn.004c9c38
add esp, 4
mov dword [esp + 0xc8], eax
cmp eax, esi
je 0x4904cc
cmp byte [esp + 0x47], 0
mov dword [esp + 0x10], esi
jne 0x48f893
cmp edi, esi
jle 0x48f8bb
mov ecx, dword [esp + 0x5c]
sub ecx, eax
mov edx, edi
mov dword [esp + 0x10], edi
jmp 0x48f880
mov esi, dword [ecx + eax]
and esi, 0xffffff
mov dword [eax], esi
add eax, 4
dec edx
jne 0x48f880
jmp 0x48f8bb
cmp edi, esi
jle 0x48f8bb
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0x5c]
sub ecx, eax
mov edx, edi
mov dword [esp + 0x10], edi
lea ebx, [ebx]
mov esi, dword [eax + ecx]
mov dword [eax], esi
add eax, 4
dec edx
jne 0x48f8b0
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x11c], edi
mov edi, dword [esp + 0x70]
mov dword [esp + 0x114], ecx
lea eax, [esp + 0x114]
mov ecx, esi
mov byte [esp + 0x47], 1
mov dword [esp + 0x118], edx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], edi
call fcn.0048e1c0
cmp esi, 4
jle 0x48f917
mov eax, ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x70], eax
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x60], eax
cmp eax, dword [esp + 0x10c]
jg 0x490473
mov eax, dword [esp + 0x94]
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x108]
imul edx, eax
cmp byte [esp + 0xf], 0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x38], ecx
lea ecx, [eax + edx*4]
mov dword [esp + 0x48], ecx
je 0x48fbd8
cmp byte [esp + 0x5a], 0
jne 0x48f999
mov ecx, dword [esp + 0x108]
test ecx, ecx
jle 0x48f999
mov eax, dword [esp + 0x48]
add eax, 3
lea ebx, [ebx]
mov byte [eax], 0
add eax, 4
dec ecx
jne 0x48f990
mov esi, dword [esp + 0x88]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x94]
push esi
push edx
push eax
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0xcc]
push edx
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x4c]
push ecx
mov edx, edi
call fcn.0048d920
mov eax, dword [esp + 0x50]
xor edx, edx
xor ebx, ebx
add esp, 0x1c
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x54], edi
cmp byte [esp + 0x1d], dl
je 0x48fa04
mov ecx, dword [esp + 0xbc]
add ecx, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x78]
cmp byte [esp + 0x1a], dl
je 0x48fa1d
mov esi, dword [esp + 0xb4]
mov ebx, eax
mov dword [esp + 0x3c], eax
add esi, eax
cmp byte [esp + 0x1c], dl
je 0x48fb42
cmp dword [esp + 0xdc], edx
jle 0x48fa44
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0xac]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0xbc]
add eax, dword [esp + 0xec]
add edi, dword [esp + 0xf4]
add eax, dword [esp + 0xe4]
add edi, dword [esp + 0xe8]
xor ecx, ecx
mov dword [esp + 0x10], eax
cmp ebx, esi
jge 0x48fb18
mov eax, ebx
imul eax, dword [esp + 0x94]
sub esi, ebx
mov ebx, dword [esp + 0xac]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], esi
jmp 0x48faa0
mov esi, dword [esp + 0x30]
add ecx, dword [esp + 0xe8]
cmp esi, dword [esp + 0x54]
jge 0x48fafa
cmp dword [esp + 0xe4], 0
je 0x48fac7
mov eax, ecx
cdq
idiv edi
test eax, eax
jne 0x48fac7
inc ecx
jmp 0x48faf2
cmp dword [esp + 0xec], 0
je 0x48fae2
mov eax, ecx
cdq
idiv edi
mov edx, dword [esp + 0x10]
dec edx
cmp eax, edx
jne 0x48fae2
inc ecx
jmp 0x48faf2
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x48]
add eax, esi
mov eax, dword [edx + eax*4]
mov dword [ebx + ecx*4], eax
inc esi
inc ecx
cmp esi, dword [esp + 0x54]
jl 0x48fab1
mov edx, dword [esp + 0x94]
add ecx, dword [esp + 0xf4]
add dword [esp + 0x2c], edx
dec dword [esp + 0x3c]
jne 0x48faa0
mov eax, dword [esp + 0x10]
jmp 0x48fb1f
mov ebx, dword [esp + 0xac]
cmp byte [esp + 0x1d], 0
mov dword [esp + 0x48], ebx
je 0x48fb2e
mov dword [esp + 0x20], edi
cmp byte [esp + 0x1a], 0
je 0x48fbcb
mov dword [esp + 0x38], eax
jmp 0x48fbcb
mov edi, dword [esp + 0xac]
cmp ebx, esi
jge 0x48fba7
mov ecx, dword [esp + 0x48]
mov eax, ebx
imul eax, dword [esp + 0x94]
add eax, dword [esp + 0x30]
lea eax, [ecx + eax*4]
mov dword [esp + 0x2c], eax
mov eax, esi
sub eax, ebx
mov dword [esp + 0x48], eax
mov edi, edi
mov ecx, dword [esp + 0x54]
cmp dword [esp + 0x30], ecx
jge 0x48fb92
mov eax, dword [esp + 0x2c]
sub ecx, dword [esp + 0x30]
mov ebx, dword [eax]
mov dword [edi + edx*4], ebx
add eax, 4
inc edx
dec ecx
jne 0x48fb82
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x94]
add eax, eax
add eax, eax
add dword [esp + 0x2c], eax
dec dword [esp + 0x48]
jne 0x48fb70
cmp byte [esp + 0x1d], 0
mov dword [esp + 0x48], edi
je 0x48fbbe
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
cmp byte [esp + 0x1a], 0
je 0x48fbcb
sub esi, ebx
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x38]
imul eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov ebx, dword [esp + 0x3c]
xor esi, esi
cmp byte [esp + 0x77], 0
je 0x48fc6a
cmp byte [esp + 0x46], 0
mov dword [esp + 0x9c], esi
mov dword [esp + 0x90], esi
je 0x48fc1f
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jle 0x48fc18
sub eax, ecx
mov dword [esp + 0x90], eax
jmp 0x48fc1f
mov dword [esp + 0x90], esi
cmp byte [esp + 0x4f], 0
je 0x48fc47
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0x38]
cmp eax, ecx
jle 0x48fc40
sub eax, ecx
mov dword [esp + 0x9c], eax
jmp 0x48fc47
mov dword [esp + 0x9c], esi
cmp dword [esp + 0x50], 4
jle 0x48fc6a
mov eax, dword [esp + 0x90]
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x90], edx
mov dword [esp + 0x9c], eax
cmp dword [esp + 0x50], 3
jne 0x48fca6
cmp byte [esp + 0x5a], 0
jne 0x48fd52
cmp byte [esp + 0xf], 0
jne 0x48fd52
cmp ebx, esi
jle 0x48fd52
mov eax, dword [esp + 0x48]
add eax, 3
mov ecx, ebx
mov byte [eax], 0
add eax, 4
dec ecx
jne 0x48fc98
jmp 0x48fd52
cmp byte [esp + 0xf], 0
je 0x48fccf
cmp ebx, esi
jle 0x48fcf7
mov edx, dword [esp + 0xb8]
mov ecx, dword [esp + 0x48]
mov eax, edx
sub ecx, edx
mov esi, ebx
mov edi, dword [ecx + eax]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x48fcc2
jmp 0x48fcfe
cmp ebx, esi
jle 0x48fcf7
mov edx, dword [esp + 0xb8]
mov ecx, dword [esp + 0x48]
mov eax, edx
sub ecx, edx
mov esi, ebx
mov edi, dword [eax + ecx]
and edi, 0xffffff
mov dword [eax], edi
add eax, 4
dec esi
jne 0x48fce4
jmp 0x48fcfe
mov edx, dword [esp + 0xb8]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x11c], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x118], eax
mov dword [esp + 0x124], ecx
lea eax, [esp + 0x114]
mov ecx, edi
mov dword [esp + 0x114], edx
mov dword [esp + 0x120], ebx
call fcn.0048e1c0
cmp edi, 4
jle 0x48fd52
mov edx, dword [esp + 0x38]
mov eax, ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x38], eax
mov ebx, dword [esp + 0x68]
cmp ebx, 1
jge 0x48ff60
cmp byte [esp + 0x47], 0
jne 0x48fd81
mov ecx, dword [esp + 0x80]
cmp ecx, esi
jle 0x48fd81
mov eax, dword [esp + 0x5c]
add eax, 3
mov byte [eax], 0
add eax, 4
dec ecx
jne 0x48fd78
mov dword [esp + 0x10], esi
cmp dword [esp + 0x80], esi
jle 0x490459
mov eax, dword [esp + 0x48]
mov edx, dword [eax]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x98], edx
jmp 0x48fdac
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0x5c]
lea ecx, [esi*4]
mov eax, dword [ecx + eax]
cmp eax, edx
je 0x48fde5
cmp edx, dword [esp + 0x64]
jne 0x48ff49
mov edi, dword [esp + 0xa4]
cmp edi, 0xffffffff
je 0x48fde5
xor edx, edx
cmp eax, edi
setne dl
mov eax, edx
test eax, eax
je 0x48ff49
mov eax, esi
cdq
idiv ebx
mov edi, dword [esp + 0x70]
sub edi, eax
sub edi, dword [esp + 0x9c]
cmp dword [esp + 0x38], edi
jg 0x48ff49
mov eax, ebx
sub eax, edx
sub eax, dword [esp + 0x90]
cmp dword [esp + 0x20], eax
jg 0x48ff49
xor edi, edi
mov byte [esp + 0xd], 1
mov dword [esp + 0x2c], edi
cmp dword [esp + 0x3c], edi
jle 0x48fe9d
mov byte [esp + 0xd], 1
mov edx, esi
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
mov eax, dword [ecx + eax*4]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [ecx + esi*4]
cmp ecx, eax
je 0x48fe73
cmp eax, dword [esp + 0x64]
jne 0x48ff3c
mov eax, dword [esp + 0xa4]
cmp eax, 0xffffffff
je 0x48fe6f
xor ebx, ebx
cmp ecx, eax
setne bl
mov eax, ebx
test eax, eax
je 0x48ff3c
mov ebx, dword [esp + 0x40]
inc edi
cmp edi, dword [esp + 0x20]
jge 0x48fe7d
inc esi
jmp 0x48fe8e
lea eax, [ebx*4]
add dword [esp + 0x54], eax
xor edi, edi
add edx, ebx
mov esi, edx
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x3c]
jl 0x48fe32
mov ebx, dword [esp + 0x10]
cmp byte [esp + 0xd], 0
mov byte [esp + 0x19], 1
je 0x4904cc
cmp byte [esp + 0xf], 0
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x88]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0xe0]
mov dword [esp + 0x20], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x70], ecx
jne 0x4904cc
cmp byte [esp + 0x5b], 0
je 0x4904cc
mov ecx, dword [esp + 0x64]
cmp ecx, 0xffffffff
je 0x4904cc
cmp dword [esp + 0x50], 3
push eax
push ecx
jne 0x49048e
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0xc0]
push ecx
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x8c]
push ecx
lea eax, [esp + 0x4c]
push eax
call fcn.0048d920
add esp, 0x1c
jmp 0x4904cc
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x40]
mov byte [esp + 0xd], 0
inc esi
mov dword [esp + 0x10], esi
cmp esi, dword [esp + 0x80]
jl 0x48fda5
jmp 0x490459
mov ecx, dword [esp + 0xa4]
cmp ecx, 0xffffffff
jne 0x490170
mov dword [esp + 0x10], esi
cmp dword [esp + 0x80], esi
jle 0x490459
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, ecx
cdq
idiv esi
mov edi, dword [esp + 0x70]
sub edi, eax
sub edi, dword [esp + 0x9c]
cmp dword [esp + 0x38], edi
jg 0x490159
mov eax, esi
sub eax, edx
sub eax, dword [esp + 0x90]
cmp dword [esp + 0x20], eax
jg 0x490159
xor edi, edi
mov byte [esp + 0xd], 1
mov dword [esp + 0x54], edi
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x3c], edi
jle 0x48fe9d
mov eax, ecx
lea edx, [eax*4]
mov byte [esp + 0xd], 1
mov dword [esp + 0xd8], eax
mov dword [esp + 0x2c], edx
lea esp, [esp]
mov esi, dword [esp + 0x5c]
movzx eax, byte [esi + ecx*4 + 2]
mov dl, byte [esi + ecx*4 + 1]
mov byte [esp + 0x1b], al
movzx eax, byte [esi + ecx*4]
mov ecx, dword [esp + 0x64]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x48]
mov byte [esp + 0x18], dl
cmp dword [eax + edi*4], ecx
je 0x4900f8
mov cl, byte [eax + edi*4 + 2]
mov dl, byte [eax + edi*4 + 1]
mov al, byte [eax + edi*4]
movzx esi, cl
mov byte [esp + 0xe], al
cmp ebx, esi
jle 0x49003b
mov byte [esp + 0x2b], 0
jmp 0x490043
mov al, cl
sub al, bl
mov byte [esp + 0x2b], al
movzx eax, dl
cmp ebx, eax
jle 0x490051
mov byte [esp + 0x26], 0
jmp 0x490059
mov al, dl
sub al, bl
mov byte [esp + 0x26], al
movzx eax, byte [esp + 0xe]
mov dword [esp + 0x98], eax
cmp ebx, eax
jle 0x490070
mov byte [esp + 0x27], 0
jmp 0x49007a
mov al, byte [esp + 0xe]
sub al, bl
mov byte [esp + 0x27], al
mov eax, 0xff
sub eax, esi
cmp ebx, eax
jle 0x49008c
mov byte [esp + 0x28], 0xff
jmp 0x490093
lea eax, [ecx + ebx]
mov byte [esp + 0x28], al
movzx eax, dl
mov ecx, 0xff
sub ecx, eax
cmp ebx, ecx
jle 0x4900a8
mov byte [esp + 0x2a], 0xff
jmp 0x4900af
lea ecx, [edx + ebx]
mov byte [esp + 0x2a], cl
mov edx, 0xff
sub edx, dword [esp + 0x98]
cmp ebx, edx
jle 0x4900c4
or cl, 0xff
jmp 0x4900ca
mov cl, bl
add cl, byte [esp + 0xe]
mov al, byte [esp + 0x1b]
cmp al, byte [esp + 0x2b]
jb 0x49014c
cmp al, byte [esp + 0x28]
ja 0x49014c
mov al, byte [esp + 0x18]
cmp al, byte [esp + 0x26]
jb 0x49014c
cmp al, byte [esp + 0x2a]
ja 0x49014c
mov al, byte [esp + 0x17]
cmp al, byte [esp + 0x27]
jb 0x49014c
cmp al, cl
ja 0x49014c
mov eax, dword [esp + 0x54]
inc eax
mov dword [esp + 0x54], eax
cmp eax, dword [esp + 0x20]
jge 0x49010d
inc dword [esp + 0x30]
jmp 0x490138
mov eax, dword [esp + 0x40]
lea ecx, [eax*4]
add dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0xd8]
add ecx, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0xd8], ecx
mov dword [esp + 0x30], ecx
inc edi
cmp edi, dword [esp + 0x3c]
jge 0x48fe9d
mov ecx, dword [esp + 0x30]
jmp 0x48fff0
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x40]
mov byte [esp + 0xd], 0
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x80]
jl 0x48ff85
jmp 0x490459
mov eax, ecx
shr eax, 0x10
movzx esi, al
mov edx, ecx
shr edx, 8
mov byte [esp + 0x19], al
cmp ebx, esi
jle 0x49018c
mov byte [esp + 0x7f], 0
jmp 0x490192
sub al, bl
mov byte [esp + 0x7f], al
movzx eax, dl
mov dword [esp + 0x98], eax
cmp ebx, eax
jle 0x4901a7
mov byte [esp + 0x76], 0
jmp 0x4901af
mov al, dl
sub al, bl
mov byte [esp + 0x76], al
movzx edi, cl
cmp ebx, edi
jle 0x4901bd
mov byte [esp + 0x58], 0
jmp 0x4901c5
mov al, cl
sub al, bl
mov byte [esp + 0x58], al
mov eax, 0xff
sub eax, esi
cmp ebx, eax
jle 0x4901d7
mov byte [esp + 0x6f], 0xff
jmp 0x4901e1
mov al, bl
add al, byte [esp + 0x19]
mov byte [esp + 0x6f], al
mov eax, 0xff
sub eax, dword [esp + 0x98]
cmp ebx, eax
jle 0x4901f8
mov byte [esp + 0x4e], 0xff
jmp 0x4901ff
lea eax, [edx + ebx]
mov byte [esp + 0x4e], al
mov edx, 0xff
sub edx, edi
cmp ebx, edx
jle 0x490211
mov byte [esp + 0x19], 0xff
jmp 0x490218
lea eax, [ecx + ebx]
mov byte [esp + 0x19], al
cmp dword [esp + 0x80], 0
mov dword [esp + 0x10], 0
jle 0x490459
mov esi, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, ecx
cdq
idiv esi
mov edi, dword [esp + 0x70]
sub edi, eax
sub edi, dword [esp + 0x9c]
cmp dword [esp + 0x38], edi
jg 0x490447
mov eax, esi
sub eax, edx
sub eax, dword [esp + 0x90]
cmp dword [esp + 0x20], eax
jg 0x490447
xor esi, esi
mov edi, ecx
mov byte [esp + 0xd], 1
mov dword [esp + 0x54], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
cmp dword [esp + 0x3c], esi
jle 0x48fe9d
mov eax, ecx
lea ecx, [eax*4]
mov byte [esp + 0xd], 1
mov dword [esp + 0x98], eax
mov dword [esp + 0xd8], ecx
mov eax, dword [esp + 0x5c]
mov dl, byte [eax + edi*4 + 1]
mov cl, byte [eax + edi*4 + 2]
mov al, byte [eax + edi*4]
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x48]
mov byte [esp + 0x18], dl
mov edx, dword [eax + esi*4]
mov byte [esp + 0x1b], cl
cmp edx, dword [esp + 0x64]
jne 0x49030e
cmp cl, byte [esp + 0x7f]
jb 0x4903de
cmp cl, byte [esp + 0x6f]
ja 0x4903de
mov cl, byte [esp + 0x18]
cmp cl, byte [esp + 0x76]
jb 0x4903de
cmp cl, byte [esp + 0x4e]
ja 0x4903de
mov cl, byte [esp + 0x17]
cmp cl, byte [esp + 0x58]
jb 0x4903de
cmp cl, byte [esp + 0x19]
ja 0x4903de
mov cl, byte [eax + esi*4 + 2]
mov dl, byte [eax + esi*4 + 1]
mov al, byte [eax + esi*4]
movzx esi, cl
mov byte [esp + 0xe], al
cmp ebx, esi
jle 0x49032b
mov byte [esp + 0x2b], 0
jmp 0x490333
mov al, cl
sub al, bl
mov byte [esp + 0x2b], al
movzx eax, dl
cmp ebx, eax
jle 0x490341
mov byte [esp + 0x26], 0
jmp 0x490349
mov al, dl
sub al, bl
mov byte [esp + 0x26], al
mov al, byte [esp + 0xe]
movzx edi, al
cmp ebx, edi
jle 0x49035b
mov byte [esp + 0x27], 0
jmp 0x490361
sub al, bl
mov byte [esp + 0x27], al
mov eax, 0xff
sub eax, esi
cmp ebx, eax
jle 0x490373
mov byte [esp + 0x28], 0xff
jmp 0x49037a
lea eax, [ecx + ebx]
mov byte [esp + 0x28], al
movzx eax, dl
mov ecx, 0xff
sub ecx, eax
cmp ebx, ecx
jle 0x49038f
mov byte [esp + 0x2a], 0xff
jmp 0x490396
lea ecx, [edx + ebx]
mov byte [esp + 0x2a], cl
mov edx, 0xff
sub edx, edi
cmp ebx, edx
jle 0x4903a6
or cl, 0xff
jmp 0x4903ac
mov cl, bl
add cl, byte [esp + 0xe]
mov al, byte [esp + 0x1b]
cmp al, byte [esp + 0x2b]
jb 0x49043a
cmp al, byte [esp + 0x28]
ja 0x49043a
mov al, byte [esp + 0x18]
cmp al, byte [esp + 0x26]
jb 0x49043a
cmp al, byte [esp + 0x2a]
ja 0x49043a
mov al, byte [esp + 0x17]
cmp al, byte [esp + 0x27]
jb 0x49043a
cmp al, cl
ja 0x49043a
mov eax, dword [esp + 0x54]
inc eax
mov dword [esp + 0x54], eax
cmp eax, dword [esp + 0x20]
jge 0x4903f4
mov edi, dword [esp + 0x30]
inc edi
jmp 0x49041e
mov eax, dword [esp + 0x40]
mov edi, dword [esp + 0x98]
lea ecx, [eax*4]
add dword [esp + 0xd8], ecx
add edi, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x98], edi
mov esi, dword [esp + 0x2c]
inc esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
cmp esi, dword [esp + 0x3c]
jl 0x4902a2
jmp 0x48fe9d
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x40]
mov byte [esp + 0xd], 0
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x80]
jl 0x490232
mov eax, dword [esp + 0x60]
inc eax
mov dword [esp + 0x60], eax
cmp eax, dword [esp + 0x10c]
jle 0x48f930
mov ebx, dword [esp + 0x10]
mov eax, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4eb75c
push eax
call fcn.004aefb0
jmp 0x48fea1
mov ecx, dword [esp + 0xc0]
push ecx
lea eax, [esp + 0xc0]
push eax
lea ecx, [esp + 0xcc]
push ecx
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x4c]
push ecx
call fcn.0048d920
add esp, 0x1c
jmp 0x4904cc
mov dword [esp + 0xc0], 0
mov ebx, dword [esp + 0x10]
cmp byte [esp + 0x1f], 0
je 0x48f2bc
mov edx, dword [esp + 0xa8]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x48f2cc
cmp byte [esp + 0x19], 0
jne 0x49050f
mov eax, dword [0x51b6d0]
push 0x18
push 0
push 2
call fcn.00401590
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp byte [esp + 0xd], 0
je 0x48f3b1
mov ecx, dword [esp + 0x50]
cmp ecx, 3
je 0x490540
mov ecx, dword [esp + 0x70]
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x50]
mov eax, ebx
call fcn.0048d8a0
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov ebx, eax
mov eax, ebx
cdq
idiv dword [esp + 0x40]
cmp byte [esp + 0x1f], 0
je 0x49055b
mov esi, dword [ebp + 0xc]
add esi, edx
mov edx, dword [ebp + 0x10]
lea edi, [eax + edx]
jmp 0x490573
sub edx, dword [esp + 0xcc]
sub eax, dword [esp + 0xd0]
add edx, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov esi, edx
mov edi, eax
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x490667
cmp ecx, 1
je 0x4905bb
cmp ecx, 7
je 0x4905bb
cmp ecx, 2
je 0x4905c6
cmp ecx, 8
je 0x4905c6
test ecx, ecx
je 0x49059f
cmp ecx, 6
jne 0x4905aa
mov ecx, 1
sub ecx, dword [esp + 0x20]
add esi, ecx
mov ebx, dword [esp + 0x38]
cmp byte [esp + 0x1d], 0
je 0x4905d5
mov dword [esp + 0x34], esi
jmp 0x4905d9
mov ecx, 1
sub ecx, dword [esp + 0x20]
add esi, ecx
mov ebx, dword [esp + 0x38]
mov edx, 1
sub edx, ebx
add edi, edx
jmp 0x4905ae
add dword [esp + 0x34], esi
cmp byte [esp + 0x1a], 0
je 0x4905e6
mov dword [esp + 0x78], edi
jmp 0x4905ea
add dword [esp + 0x78], edi
cmp eax, 1
jne 0x49061f
call fcn.00413e50
mov ecx, eax
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
push 0
push ecx
call fcn.004d94d0
add esi, eax
call fcn.00413e50
mov ecx, eax
mov eax, ebx
cdq
push edx
push eax
push 0
push ecx
call fcn.004d94d0
add edi, eax
jmp 0x49068d
cmp eax, 2
jne 0x49063a
mov eax, dword [esp + 0x20]
cdq
sub eax, edx
sar eax, 1
add esi, eax
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add edi, eax
jmp 0x49068d
cmp eax, 4
jne 0x490645
lea edi, [edi + ebx - 1]
jmp 0x49068d
cmp eax, 5
jne 0x490654
mov edx, dword [esp + 0x20]
lea esi, [esi + edx - 1]
jmp 0x49068d
cmp eax, 6
jne 0x49068d
mov eax, dword [esp + 0x20]
lea esi, [esi + eax - 1]
lea edi, [edi + ebx - 1]
jmp 0x49068d
cmp byte [esp + 0x1d], 0
je 0x490674
mov dword [esp + 0x34], esi
jmp 0x490678
add dword [esp + 0x34], esi
cmp byte [esp + 0x1a], 0
mov ebx, dword [esp + 0x38]
je 0x490689
mov dword [esp + 0x78], edi
jmp 0x49068d
add dword [esp + 0x78], edi
mov ecx, dword [esp + 0x12c]
test ecx, ecx
je 0x4906a6
mov eax, esi
cdq
push 0x18
push edx
push eax
mov eax, ecx
call fcn.00401590
mov ecx, dword [esp + 0x128]
test ecx, ecx
je 0x4906bf
mov eax, edi
cdq
push 0x18
push edx
push eax
mov eax, ecx
call fcn.00401590
cmp byte [esp + 0x59], 0
jne 0x4906ca
inc dword [esp + 0x60]
cmp byte [esp + 0x5b], 0
je 0x490733
mov ecx, dword [esp + 0xbc]
test ecx, ecx
jne 0x4906e0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xb4]
test eax, eax
jne 0x4906ed
mov eax, ebx
mov edx, dword [esp + 0x60]
push 0xffffffffffffffff
push 0xffffffffffffffff
push edx
mov edx, dword [esp + 0x2c]
push ebx
push edx
push eax
mov eax, dword [esp + 0x90]
push ecx
push eax
mov eax, dword [esp + 0x54]
call fcn.0048daa0
add esp, 0x20
test eax, eax
je 0x490728
mov ecx, dword [esp + 0xf0]
mov edi, eax
call fcn.004af2e0
test eax, eax
jne 0x490752
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp dword [esp + 0xf0], 0
je 0x490752
mov eax, dword [esp + 0x60]
cdq
push 0x18
push edx
push eax
mov eax, dword [esp + 0xfc]
call fcn.00401590
mov ecx, dword [0x51b6d0]
push 1
push 0
push 0xffffffffffffffff
push 0x4e6a28
push ecx
call fcn.004aefb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 8]
push 0x4f5ac4
push 0
push 0x4ebe14
call fcn.0042dac0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18