Function at 0x471290
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bdc07
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x621d30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x88], eax
lea ebx, [eax + 0xb8]
mov dword [ebp - 4], 1
mov dword [ebp - 0x90], ebx
call fcn.0046fe80
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xdc], esp
mov esi, esp
push eax
call fcn.00453e70
add eax, 0x10
mov dword [esi], eax
add esp, 4
lea esi, [ebp - 0xb8]
call fcn.004841e0
mov byte [ebp - 4], 2
mov byte [ebp - 0xa8], 1
call fcn.0048a293
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x47132c
push 0x80004005
call fcn.00453e40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x80], eax
lea ecx, [ebp - 0xb8]
push ecx
lea esi, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.00484310
lea edx, [ebp - 0x9c]
push edx
mov ecx, esi
call fcn.00484420
lea eax, [ebp - 0x84]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.004845d0
mov edi, esi
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 5
call fcn.00484730
mov byte [ebp - 4], 6
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
call esi
push 0x20
mov edi, eax
call esi
push 0x21
mov ebx, eax
call esi
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.00484a10
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push 1
add edx, esi
mov esi, dword [ebp - 0x88]
add edx, edi
push edx
add eax, ebx
push eax
push 0
push 0
mov ecx, esi
call fcn.0048d782
lea ecx, [ebp - 0x80]
lea edi, [esi + 0x120bc]
push ecx
call fcn.00484e00
lea edx, [ebp - 0x80]
push edx
push edi
call fcn.004877d0
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, esi
call fcn.0048d6f7
call fcn.00474a90
mov edi, dword [edi]
push 1
push edi
mov ecx, esi
call fcn.0048a77c
lea ecx, [ebp - 0xb8]
push ecx
lea esi, [ebp - 0x80]
call fcn.00484310
lea edx, [ebp - 0xc4]
push edx
mov ecx, esi
call fcn.00484420
push eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 7
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xc4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471459
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x88]
nop
mov esi, dword [ebp - 0x9c]
mov ecx, 0x5ee420
mov eax, esi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x471496
test dx, dx
je 0x471492
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x471496
add eax, 4
add ecx, 4
test dx, dx
jne 0x471470
xor eax, eax
jmp 0x47149b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x474981
mov ecx, str._ah
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4714d6
test dx, dx
je 0x4714d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4714d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4714b0
xor eax, eax
jmp 0x4714db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x471703
lea ecx, [ebp - 0x19c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
mov byte [ebp - 4], 8
mov ecx, dword [eax]
mov esi, dword [ebp - 0x84]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x47155e
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47154e
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47154e
push eax
call fcn.00453e70
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47153d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x84], ebx
mov ebx, dword [ebp - 0x88]
jmp 0x47155e
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.00453d90
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x19c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471584
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x178]
call fcn.00484730
mov byte [ebp - 4], 9
mov ecx, dword [eax]
mov esi, dword [ebp - 0x8c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x4715f9
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4715e9
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4715e9
push eax
call fcn.00453e70
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4715d8
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x8c], ebx
mov ebx, dword [ebp - 0x88]
jmp 0x4715f9
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x8c]
call fcn.00453d90
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x178]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47161f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x94
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x471650
push eax
call fcn.0046e320
mov edi, eax
jmp 0x471652
xor edi, edi
push 0xffff
push ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8c]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push eax
push 0x54000100
push ecx
mov ecx, edi
call edx
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x31
push eax
call esi
push eax
call fcn.0048c6a6
test eax, eax
jne 0x4716b8
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x4716aa
push 0xc
call ebx
test eax, eax
je 0x4716b4
push eax
call fcn.0048c6a6
test eax, eax
jne 0x4716b8
xor eax, eax
jmp 0x4716bb
mov eax, dword [eax + 4]
mov ecx, dword [edi + 0x20]
push 1
push eax
push 0x30
push ecx
call esi
lea edx, [ebp - 0x80]
push edx
push 0
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0
call fcn.0046fc50
jmp 0x4748c3
mov ecx, 0x5ee434
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x471736
test dx, dx
je 0x471732
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x471736
add eax, 4
add ecx, 4
test dx, dx
jne 0x471710
xor eax, eax
jmp 0x47173b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x471978
lea edx, [ebp - 0x180]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
mov byte [ebp - 4], 0xb
mov ecx, dword [eax]
mov esi, dword [ebp - 0x84]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x4717b8
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4717a8
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4717a8
push eax
call fcn.00453e70
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47179d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x84], ebx
jmp 0x4717b8
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.00453d90
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x180]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4717de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x188]
call fcn.00484730
mov byte [ebp - 4], 0xc
mov ecx, dword [eax]
mov esi, dword [ebp - 0x8c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x47184d
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47183d
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47183d
push eax
call fcn.00453e70
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x471832
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x8c], ebx
jmp 0x47184d
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x8c]
call fcn.00453d90
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x188]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471873
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0xf4
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x4718a4
push eax
call fcn.0046b4b0
mov ebx, eax
jmp 0x4718a6
xor ebx, ebx
mov esi, dword [ebp - 0x88]
push 0
push 0xffff
push esi
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebx]
mov edx, dword [edx + 0x54]
push 0x54000100
push ecx
push 0
mov ecx, ebx
call edx
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x180]
push ecx
mov ecx, ebx
call edx
mov eax, dword [esi + 0x20]
push 0
push 0
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
call fcn.0048c6a6
mov esi, eax
test esi, esi
jne 0x471920
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call edi
test eax, eax
jne 0x471918
push 0xc
call edi
test eax, eax
je 0x471920
push eax
call fcn.0048c6a6
mov esi, eax
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x7c]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebx]
mov edx, dword [eax + 0x198]
sub esp, 0x5c
mov edi, esp
mov ecx, 0x17
lea esi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call edx
lea eax, [ebp - 0x80]
push eax
push 6
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00485020
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 6
mov edi, ebx
call fcn.0046fc50
jmp 0x4748c3
mov ecx, 0x5ee43c
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4719a6
test dx, dx
je 0x4719a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4719a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x471980
xor eax, eax
jmp 0x4719ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x471b6f
lea ecx, [ebp - 0x190]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xe
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x190]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4719fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x198]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0xf
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x198]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471a41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x80
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x471a72
push eax
call fcn.0046a750
mov edi, eax
jmp 0x471a74
xor edi, edi
push 0xffff
push ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8c]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push eax
push 0x54004300
push ecx
mov ecx, edi
call edx
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x31
push eax
call esi
push eax
call fcn.0048c6a6
test eax, eax
jne 0x471ada
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x471acc
push 0xc
call ebx
test eax, eax
je 0x471ad6
push eax
call fcn.0048c6a6
test eax, eax
jne 0x471ada
xor eax, eax
jmp 0x471add
mov eax, dword [eax + 4]
mov ecx, dword [edi + 0x20]
push 1
push eax
push 0x30
push ecx
call esi
mov ebx, dword [ebp - 0x84]
lea eax, [ebx - 0x10]
push eax
call fcn.00453e70
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp - 0x94], esi
lea edx, [ebp - 0x94]
lea ecx, [edi + 0x78]
push edx
mov byte [ebp - 4], 0x11
call fcn.00453ee0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471b36
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x80]
push ecx
push 1
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 1
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
mov eax, dword [ebp - 0x90]
push 1
mov esi, ebx
call fcn.0046fc50
jmp 0x4748c3
mov ecx, 0x5ee444
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x471b9c
test dx, dx
je 0x471b98
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x471b9c
add eax, 4
add ecx, 4
test dx, dx
jne 0x471b76
xor eax, eax
jmp 0x471ba1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x471e91
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x12
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1a0]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x471bf3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x144]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x13
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x144]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471c37
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0xa4
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x14
test eax, eax
je 0x471c69
mov esi, eax
call fcn.0046af20
mov edi, eax
jmp 0x471c6b
xor edi, edi
lea edx, [ebp - 0x80]
push edx
push 2
mov edx, edi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 6
call fcn.00485020
cmp byte [edi + 0xa0], 0
je 0x471d4e
mov al, byte [edi + 0xa1]
test al, al
je 0x471d0e
cmp byte [edi + 0xa2], 0
jne 0x471ccb
push 0xffff
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x54801044
mov ecx, edi
call fcn.0048e356
mov ecx, dword [edi + 0x20]
push 1
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x471d64
test al, al
je 0x471d0e
cmp byte [edi + 0xa2], 0
je 0x471d0a
push 0xffff
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x548010c4
mov ecx, edi
call fcn.0048e356
mov eax, dword [edi + 0x20]
mov esi, dword [sym.imp.USER32.dll_ShowScrollBar]
push 1
push 1
push eax
call esi
mov ecx, dword [edi + 0x20]
push 1
push 0
push ecx
call esi
jmp 0x471d64
test al, al
jne 0x471d3d
cmp byte [edi + 0xa2], 0
je 0x471d3d
push 0xffff
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x54801084
mov ecx, edi
call fcn.0048e356
mov eax, dword [edi + 0x20]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x471d64
push 0xffff
push ebx
lea ecx, [ebp - 0x20]
push ecx
push 0x54801044
jmp 0x471d5d
push 0xffff
push ebx
lea edx, [ebp - 0x20]
push edx
push 0x54800080
mov ecx, edi
call fcn.0048e356
cmp byte [edi + 0x9f], 0
jne 0x471d7d
push 0
push 0x8000000
push 0
mov ecx, edi
call fcn.0048d69f
cmp byte [edi + 0x9e], 0
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
je 0x471d9b
mov eax, dword [edi + 0x20]
push 0
push 1
push 0xcf
push eax
call ebx
cmp byte [edi + 0x9c], 0
je 0x471db3
mov ecx, dword [edi + 0x20]
push 0
push 0x2a
push 0xcc
push ecx
call ebx
cmp byte [edi + 0x9d], 0
je 0x471dcc
push 0
push 0x2000
push 0
mov ecx, edi
call fcn.0048d69f
mov eax, dword [edi + 0x84]
test eax, eax
je 0x471de0
mov esi, edi
mov dword [edi + 0x74], eax
call fcn.0046b280
mov eax, dword [edi + 0x88]
cmp eax, 0xffffff
je 0x471df7
mov esi, edi
mov dword [edi + 0x78], eax
call fcn.0046b280
mov edx, dword [ebp - 0x88]
mov eax, dword [edx + 0x20]
push 0
push 0
push 0x31
push eax
call ebx
push eax
call fcn.0048c6a6
mov esi, eax
test esi, esi
jne 0x471e35
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x471e2d
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x471e35
push eax
call fcn.0048c6a6
mov esi, eax
mov ecx, dword [edi + 0x20]
push 0
push 0xffff
push 0xc5
push ecx
call ebx
test esi, esi
je 0x471e4e
mov esi, dword [esi + 4]
mov edx, dword [edi + 0x20]
push 1
push esi
push 0x30
push edx
call ebx
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, edi
call fcn.0048d6f7
push 2
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 2
call fcn.0046fc50
jmp 0x4748c3
lea eax, [ebp - 0x9c]
push 0x5ee44c
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x472017
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x15
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x471ef2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x174]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x16
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x174]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471f36
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x7c
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x471f64
push eax
call fcn.0046df10
mov edi, eax
jmp 0x471f66
xor edi, edi
push 0xffff
push ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8c]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push eax
push 0x54000009
push ecx
mov ecx, edi
call edx
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x31
push eax
call esi
push eax
call fcn.0048c6a6
test eax, eax
jne 0x471fcc
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x471fbe
push 0xc
call ebx
test eax, eax
je 0x471fc8
push eax
call fcn.0048c6a6
test eax, eax
jne 0x471fcc
xor eax, eax
jmp 0x471fcf
mov eax, dword [eax + 4]
mov ecx, dword [edi + 0x20]
push 1
push eax
push 0x30
push ecx
call esi
lea edx, [ebp - 0x80]
push edx
push 3
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 3
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 3
call fcn.0046fc50
jmp 0x4748c3
lea edx, [ebp - 0x9c]
push 0x5ee454
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x47219d
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x18
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xf4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x472078
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x14c]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x19
call fcn.00453ee0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x14c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4720bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x7c
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x1a
test eax, eax
je 0x4720ea
push eax
call fcn.0046a9e0
mov edi, eax
jmp 0x4720ec
xor edi, edi
push 0xffff
push ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8c]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push eax
push 0x54000003
push ecx
mov ecx, edi
call edx
mov eax, dword [ebx + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x31
push eax
call esi
push eax
call fcn.0048c6a6
test eax, eax
jne 0x472152
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x472144
push 0xc
call ebx
test eax, eax
je 0x47214e
push eax
call fcn.0048c6a6
test eax, eax
jne 0x472152
xor eax, eax
jmp 0x472155
mov eax, dword [eax + 4]
mov ecx, dword [edi + 0x20]
push 1
push eax
push 0x30
push ecx
call esi
lea edx, [ebp - 0x80]
push edx
push 4
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 4
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 4
call fcn.0046fc50
jmp 0x4748c3
lea edx, [ebp - 0x9c]
push 0x5ee45c
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x47232a
lea ecx, [ebp - 0xd8]
call fcn.0048e51d
lea eax, [ebp - 0xfc]
mov bl, 0x1b
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x1c
call fcn.00453ee0
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], bl
call fcn.00453f70
lea ecx, [ebp - 0xd8]
push ecx
lea ebx, [ebp - 0x80]
call fcn.00488cc0
lea edx, [ebp - 0x20]
push edx
mov ecx, ebx
call fcn.00484a10
push 0x80
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x1d
test eax, eax
je 0x472236
mov esi, eax
call fcn.0046ac10
mov edi, eax
jmp 0x472238
xor edi, edi
mov esi, dword [ebp - 0x88]
push 0xffff
push esi
mov byte [ebp - 4], 0x1b
mov eax, dword [edi]
mov edx, dword [eax + 0x160]
lea ecx, [ebp - 0x20]
push ecx
push 0x54200002
mov ecx, edi
call edx
mov ecx, esi
call fcn.00453490
test eax, eax
jne 0x47228c
mov esi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call esi
test eax, eax
jne 0x47227e
push 0xc
call esi
test eax, eax
je 0x472288
push eax
call fcn.0048c6a6
test eax, eax
jne 0x47228c
xor eax, eax
jmp 0x47228f
mov eax, dword [eax + 4]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push eax
mov eax, dword [edi + 0x20]
push 0x30
push eax
call ebx
mov eax, dword [ebp - 0xd0]
xor esi, esi
test eax, eax
jle 0x4722de
test esi, esi
js 0x47497c
cmp esi, eax
jge 0x47497c
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ecx + esi*4]
mov edx, dword [edi + 0x20]
push eax
push 0
push 0x143
push edx
call ebx
mov eax, dword [ebp - 0xd0]
inc esi
cmp esi, eax
jl 0x4722ac
lea eax, [ebp - 0x80]
push eax
push 5
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 5
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
push 5
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
call fcn.0046fc50
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 6
call fcn.0048e75b
jmp 0x4748c3
lea eax, [ebp - 0x9c]
push 0x5ee464
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x4724d1
lea ecx, [ebp - 0xd8]
call fcn.0048e51d
lea ecx, [ebp - 0x18c]
push ecx
mov bl, 0x1e
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x1f
call fcn.00453ee0
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], bl
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x104]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x20
call fcn.00453ee0
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], bl
call fcn.00453f70
lea edx, [ebp - 0xd8]
push edx
mov ebx, edi
call fcn.00488cc0
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.00484a10
push 0x1ec
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x4723ed
push eax
call fcn.0046c7e0
mov edi, eax
jmp 0x4723ef
xor edi, edi
mov esi, dword [ebp - 0x88]
push 0xffff
push esi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x8c]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push eax
push 0x54800120
push ecx
mov ecx, edi
call edx
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, edi
call fcn.0048d6f7
mov ecx, esi
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472454
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x47244c
push 0xc
call ebx
test eax, eax
je 0x472454
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
mov eax, dword [ebp - 0xd0]
xor esi, esi
test eax, eax
jle 0x4724a5
lea ebx, [ebx]
test esi, esi
js 0x47497c
cmp esi, eax
jge 0x47497c
mov ecx, dword [ebp - 0xd4]
mov edx, dword [edi]
push 0xffffffffffffffff
lea eax, [ecx + esi*4]
push 0
push eax
mov eax, dword [edx + 0x168]
mov ecx, edi
call eax
mov eax, dword [ebp - 0xd0]
inc esi
cmp esi, eax
jl 0x472470
lea ecx, [ebp - 0x80]
push ecx
push 7
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 7
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
push 7
jmp 0x472305
lea ecx, [ebp - 0x9c]
push 0x5ee46c
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x4725cb
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x22
call fcn.00453ee0
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 6
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x78
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x23
test eax, eax
je 0x47254a
mov esi, eax
call fcn.0046de40
mov edi, eax
jmp 0x47254c
xor edi, edi
push 0xffff
push ebx
mov byte [ebp - 4], 6
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472596
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x47258e
push 0xc
call ebx
test eax, eax
je 0x472596
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 8
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 8
call fcn.0046fc50
jmp 0x4748c3
lea ecx, [ebp - 0x9c]
push 0x5ee474
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x4726c5
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x24
call fcn.00453ee0
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 6
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x78
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x25
test eax, eax
je 0x472644
mov esi, eax
call fcn.0046ae70
mov edi, eax
jmp 0x472646
xor edi, edi
push 0xffff
push ebx
mov byte [ebp - 4], 6
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472690
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x472688
push 0xc
call ebx
test eax, eax
je 0x472690
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 9
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 9
call fcn.0046fc50
jmp 0x4748c3
lea ecx, [ebp - 0x9c]
push 0x5ee47c
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x4727d0
lea edx, [ebp - 0x17c]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x26
call fcn.00453ee0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 6
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x7c
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x27
test eax, eax
je 0x47273d
push eax
call fcn.0046e0b0
mov edi, eax
jmp 0x47273f
xor edi, edi
push 0xffff
push ebx
mov byte [ebp - 4], 6
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472789
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x472781
push 0xc
call ebx
test eax, eax
je 0x472789
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xb
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xb
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xb
call fcn.0046fc50
jmp 0x4748c3
lea eax, [ebp - 0x9c]
push 0x5ee484
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x4728e3
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x28
call fcn.00453ee0
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 6
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0xb4
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x29
test eax, eax
je 0x47284b
push eax
call fcn.0046cca0
mov edi, eax
jmp 0x47284d
xor edi, edi
push 0xffff
push ebx
lea ecx, [ebp - 0x20]
push ecx
mov byte [ebp - 4], 6
mov eax, dword [edi]
mov edx, dword [eax + 0x160]
push 0x5400010e
push 0x5ee484
mov ecx, edi
call edx
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x47289c
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x472894
push 0xc
call ebx
test eax, eax
je 0x47289c
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xa
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xa
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xa
call fcn.0046fc50
jmp 0x4748c3
lea eax, [ebp - 0x9c]
push str.OmFh
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x4729f7
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x2a
call fcn.00453ee0
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 6
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0xc4
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x47295e
push eax
call fcn.0046cab0
mov edi, eax
jmp 0x472960
xor edi, edi
push 0xffff
push ebx
lea eax, [ebp - 0x20]
push eax
push 0x14800080
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0048e356
push 0
push 0
mov ecx, edi
call fcn.0048f5a5
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4729b0
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x4729a8
push 0xc
call ebx
test eax, eax
je 0x4729b0
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea ecx, [ebp - 0x80]
push ecx
push 0xc
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xc
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xc
call fcn.0046fc50
jmp 0x4748c3
lea ecx, [ebp - 0x9c]
push 0x5ee494
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x472b26
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x2c
call fcn.00453ee0
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 6
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x88
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x2d
test eax, eax
je 0x472a72
push eax
call fcn.0046f260
mov edi, eax
jmp 0x472a74
xor edi, edi
push 0xffff
push ebx
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 6
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0x5400090e
push 0x5ee494
mov ecx, edi
call edx
lea eax, [edi + 0x78]
test eax, eax
je 0x472aa2
mov eax, dword [eax + 4]
push eax
mov eax, dword [edi + 0x20]
push 0
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472adf
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x472ad7
push 0xc
call ebx
test eax, eax
je 0x472adf
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea ecx, [ebp - 0x80]
push ecx
push 0xe
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xe
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xe
call fcn.0046fc50
jmp 0x4748c3
lea ecx, [ebp - 0x9c]
push 0x5ee49c
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x472c55
lea edx, [ebp - 0xe0]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x2e
call fcn.00453ee0
lea ecx, [ebp - 0xe0]
mov byte [ebp - 4], 6
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x88
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x2f
test eax, eax
je 0x472ba1
push eax
call fcn.0046c410
mov edi, eax
jmp 0x472ba3
xor edi, edi
push 0xffff
push ebx
mov byte [ebp - 4], 6
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, ebx
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472bed
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x472be5
push 0xc
call ebx
test eax, eax
je 0x472bed
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xf
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
movzx ecx, word [edi + 0x84]
movzx edx, word [edi + 0x82]
push ecx
push edx
push edi
call fcn.004533b0
xor edx, edx
xor ecx, ecx
mov esi, edi
call fcn.0046c5d0
push 0xf
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xf
call fcn.0046fc50
jmp 0x4748c3
lea edx, [ebp - 0x9c]
push str.OmhV
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x472d49
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x30
call fcn.00453ee0
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 6
call fcn.00453f70
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x170
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x31
test eax, eax
je 0x472cd1
mov esi, eax
call fcn.00480080
mov edi, eax
jmp 0x472cd3
xor edi, edi
mov byte [ebp - 4], 6
mov edx, dword [edi]
mov eax, dword [edx + 0x160]
push ebx
push 0x68
mov ecx, edi
call eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x20]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, edi
call fcn.0048d782
push 1
mov ecx, edi
call fcn.0048d7c2
lea eax, [ebp - 0x80]
push eax
push 0x10
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0x10
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0x10
call fcn.0046fc50
jmp 0x4748c9
lea eax, [ebp - 0x9c]
push 0x5ee4ac
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x472ed3
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x32
call fcn.00453ee0
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 6
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x4bc
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x33
test eax, eax
je 0x472dc4
push eax
call fcn.00457600
mov ebx, eax
jmp 0x472dc6
xor ebx, ebx
mov esi, dword [ebp - 0x88]
push esi
lea ecx, [ebp - 0x20]
mov edx, ebx
mov byte [ebp - 4], 6
call fcn.00458000
mov ecx, esi
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472e06
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call edi
test eax, eax
jne 0x472dfe
push 0xc
call edi
test eax, eax
je 0x472e06
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, ebx
call fcn.00453460
mov eax, dword [ebx + 0x164]
mov edx, dword [eax + 0x24]
lea ecx, [ebx + 0x164]
push 0xe0ffff
call edx
mov eax, ebx
call fcn.0045f380
push 0xf
mov dword [ebx + 0x9c], 0
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, eax
mov esi, ebx
call fcn.0044ec30
lea eax, [ebp - 0x80]
push eax
push 0x11
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00485020
cmp dword [ebx + 0x118], 0
jne 0x472ea7
xor esi, esi
cmp dword [ebx + 0x120], esi
jle 0x472ea7
mov edi, edi
test esi, esi
js 0x472e9e
cmp esi, dword [ebx + 0x120]
jge 0x472e9e
cmp esi, dword [ebx + 0x138]
jge 0x47497c
mov ecx, dword [ebx + 0x134]
lea eax, [ecx + esi*4]
mov ecx, ebx
mov dword [eax], 0x19
call fcn.0045d630
inc esi
cmp esi, dword [ebx + 0x120]
jl 0x472e70
push 0x11
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
mov edi, ebx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0x11
call fcn.0046fc50
jmp 0x4748c3
lea ecx, [ebp - 0x9c]
push 0x5ee4b4
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x4748c9
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x34
call fcn.00453ee0
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 6
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push pe_nt_image_headers32
call fcn.004896de
add esp, 4
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x35
test eax, eax
je 0x472f54
push eax
call fcn.0046e910
mov ebx, eax
mov dword [ebp - 0x94], ebx
jmp 0x472f64
mov dword [ebp - 0x94], 0
mov ebx, dword [ebp - 0x94]
mov esi, dword [ebp - 0x88]
push 0xffff
push esi
mov byte [ebp - 4], 6
mov edx, dword [ebx]
mov edx, dword [edx + 0x160]
lea eax, [ebp - 0x20]
push eax
push 0x14000200
mov ecx, ebx
call edx
mov ecx, esi
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x472fb4
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call edi
test eax, eax
jne 0x472fac
push 0xc
call edi
test eax, eax
je 0x472fb4
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, ebx
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xd
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xd
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
mov edi, ebx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xd
call fcn.0046fc50
lea eax, [ebp - 0x80]
push 0x5ee4bc
push eax
mov dword [ebp - 0x98], 0
call fcn.00452f50
add esp, 8
test al, al
je 0x474892
jmp 0x473020
lea ecx, [ebp - 0xb8]
push ecx
lea esi, [ebp - 0x80]
call fcn.00484310
mov edx, esi
push 0x5ee4bc
push edx
call fcn.00453500
add esp, 8
test al, al
jne 0x474892
lea eax, [ebp - 0x184]
push eax
mov ecx, esi
call fcn.00484420
lea ecx, [ebp - 0x184]
call fcn.00453f70
lea ecx, [ebp - 0xc4]
push ecx
call fcn.004848d0
mov byte [ebp - 4], 0x36
mov eax, dword [ebp - 0xc4]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xa0], esp
mov esi, esp
push eax
call fcn.00453e70
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.0046eb80
lea ecx, [ebp - 0xbc]
call fcn.00453b50
lea ecx, [ebp - 0xc0]
call fcn.00453b50
lea edx, [ebp - 0xc0]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x38
call fcn.004875d0
test al, al
je 0x47317e
nop
lea ecx, [ebp - 0xbc]
push 0x5ee4c8
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x473114
mov edx, dword [ebp - 0xc0]
push edx
call fcn.00591f13
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebx + ecx*4 + 0x80]
add esp, 4
push 1
push eax
mov dword [ecx + 0xb8], eax
call fcn.0048a77c
jmp 0x473160
lea edx, [ebp - 0xbc]
push 0x5ee4d4
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x473160
mov eax, dword [ebp - 0xc0]
push 1
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xa0], esp
mov esi, esp
push eax
call fcn.00453e70
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp - 0x98]
mov edi, dword [ebx + eax*4 + 0x80]
add esp, 4
call fcn.0046f0f0
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0xbc]
push edx
lea ecx, [ebp - 0x80]
call fcn.004875d0
test al, al
jne 0x4730d0
lea eax, [ebp - 0x80]
push 0x5ee4e0
push eax
mov byte [ebp - 0xa8], 1
call fcn.00452f50
add esp, 8
test al, al
je 0x47484e
lea ecx, [ebp - 0xb8]
push ecx
lea esi, [ebp - 0x80]
call fcn.00484310
mov edx, esi
push 0x5ee4e0
push edx
call fcn.00453500
add esp, 8
test al, al
jne 0x47484e
lea eax, [ebp - 0xa4]
push eax
mov ecx, esi
call fcn.00484420
lea ecx, [ebp - 0xa4]
push str._ah
push ecx
mov byte [ebp - 4], 0x39
call fcn.00453500
add esp, 8
test al, al
je 0x473329
lea edx, [ebp - 0x134]
push edx
mov ecx, esi
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x3a
call fcn.00453ee0
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x39
call fcn.00453f70
mov edi, esi
lea ecx, [ebp - 0x16c]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x3b
call fcn.00453ee0
lea ecx, [ebp - 0x16c]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.00484a10
push 0x94
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x3c
test eax, eax
je 0x47327c
push eax
call fcn.0046e320
mov edi, eax
jmp 0x47327e
xor edi, edi
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0xffff
push ecx
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x20]
push eax
push 0x54000100
push ecx
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4732e2
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x4732da
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4732e2
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push 0x5ee434
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x473493
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x3d
call fcn.00453ee0
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x194]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x3e
call fcn.00453ee0
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
mov ecx, edi
call fcn.00484a10
push 0xf4
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x3f
test eax, eax
je 0x4733d0
push eax
call fcn.0046b4b0
mov ebx, eax
jmp 0x4733d2
xor ebx, ebx
mov edx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx + edx*4 + 0x80]
mov eax, dword [ebx]
push 0
push 0xffff
push ecx
mov ecx, dword [ebp - 0x8c]
lea edx, [ebp - 0x20]
push edx
mov edx, dword [eax + 0x54]
push 0x54000000
push ecx
push 0
mov ecx, ebx
call edx
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x180]
push ecx
mov ecx, ebx
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x47344e
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call edi
test eax, eax
jne 0x473446
push 0xc
call edi
test eax, eax
je 0x47344e
push eax
call fcn.0048c6a6
mov esi, eax
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x7c]
push eax
push 0x5c
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebx]
mov eax, dword [edx + 0x198]
sub esp, 0x5c
mov edi, esp
mov ecx, 0x17
lea esi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x80]
push ecx
push 6
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 6
jmp 0x47480d
lea edx, [ebp - 0xa4]
push 0x5ee43c
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x47360e
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x40
call fcn.00453ee0
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0xe8]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x41
call fcn.00453ee0
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea ecx, [ebp - 0x20]
push ecx
mov ecx, edi
call fcn.00484a10
push 0x80
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x42
test eax, eax
je 0x47353a
push eax
call fcn.0046a750
mov edi, eax
jmp 0x47353c
xor edi, edi
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0xffff
push ecx
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x20]
push eax
push 0x54004300
push ecx
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4735a0
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x473598
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4735a0
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
mov eax, dword [ebp - 0x84]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xa0], esp
mov esi, esp
push eax
call fcn.00453e70
add eax, 0x10
add esp, 4
mov ecx, edi
mov dword [esi], eax
call fcn.00470b80
lea eax, [ebp - 0x80]
push eax
push 1
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 1
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 1
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push 0x5ee444
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x4738f0
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x43
call fcn.00453ee0
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0xf8]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x44
call fcn.00453ee0
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
mov ecx, edi
call fcn.00484a10
push 0xa4
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x45
test eax, eax
je 0x4736b6
mov esi, eax
call fcn.0046af20
mov edi, eax
jmp 0x4736b8
xor edi, edi
lea eax, [ebp - 0x80]
push eax
push 2
mov edx, edi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x39
call fcn.00485020
cmp byte [edi + 0xa0], 0
je 0x4737d6
mov al, byte [edi + 0xa1]
test al, al
je 0x47377c
cmp byte [edi + 0xa2], 0
jne 0x473729
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebx + ecx*4 + 0x80]
push 0xffff
push edx
lea eax, [ebp - 0x20]
push eax
push 0x54801044
mov ecx, edi
call fcn.0048e356
mov ecx, dword [edi + 0x20]
push 1
push 1
push ecx
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x4737f9
test al, al
je 0x47377c
cmp byte [edi + 0xa2], 0
je 0x473778
mov edx, dword [ebp - 0x98]
mov eax, dword [ebx + edx*4 + 0x80]
push 0xffff
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x548010c4
mov ecx, edi
call fcn.0048e356
mov edx, dword [edi + 0x20]
mov esi, dword [sym.imp.USER32.dll_ShowScrollBar]
push 1
push 1
push edx
call esi
mov eax, dword [edi + 0x20]
push 1
push 0
push eax
call esi
jmp 0x4737f9
test al, al
jne 0x4737b8
cmp byte [edi + 0xa2], 0
je 0x4737b8
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebx + ecx*4 + 0x80]
push 0xffff
push edx
lea eax, [ebp - 0x20]
push eax
push 0x54801084
mov ecx, edi
call fcn.0048e356
mov ecx, dword [edi + 0x20]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowScrollBar]
jmp 0x4737f9
mov edx, dword [ebp - 0x98]
mov eax, dword [ebx + edx*4 + 0x80]
push 0xffff
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x54801044
jmp 0x4737f2
mov edx, dword [ebp - 0x98]
mov eax, dword [ebx + edx*4 + 0x80]
push 0xffff
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x54800080
mov ecx, edi
call fcn.0048e356
cmp byte [edi + 0x9f], 0
jne 0x473812
push 0
push 0x8000000
push 0
mov ecx, edi
call fcn.0048d69f
cmp byte [edi + 0x9e], 0
je 0x473822
mov eax, edi
call fcn.00453440
cmp byte [edi + 0x9c], 0
je 0x473832
mov eax, edi
call fcn.00453420
cmp byte [edi + 0x9d], 0
je 0x47384b
push 0
push 0x2000
push 0
mov ecx, edi
call fcn.0048d69f
mov eax, dword [edi + 0x84]
test eax, eax
je 0x47385f
mov esi, edi
mov dword [edi + 0x74], eax
call fcn.0046b280
mov eax, dword [edi + 0x88]
cmp eax, 0xffffff
je 0x473876
mov esi, edi
mov dword [edi + 0x78], eax
call fcn.0046b280
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4738a7
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x47389f
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4738a7
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
mov edx, dword [ebp - 0x8c]
push edx
mov ecx, edi
call fcn.0048d6f7
mov eax, edi
call fcn.00453400
push 2
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 2
call fcn.0046fc50
jmp 0x474826
lea edx, [ebp - 0xa4]
push 0x5ee44c
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x473a41
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x46
call fcn.00453ee0
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x108]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x47
call fcn.00453ee0
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea ecx, [ebp - 0x20]
push ecx
mov ecx, edi
call fcn.00484a10
push 0x7c
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x48
test eax, eax
je 0x473994
push eax
call fcn.0046df10
mov edi, eax
jmp 0x473996
xor edi, edi
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0xfffc
push ecx
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x20]
push eax
push 0x54000009
push ecx
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4739fa
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x4739f2
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4739fa
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 3
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 3
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 3
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push 0x5ee454
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x473b92
lea ecx, [ebp - 0x110]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x49
call fcn.00453ee0
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x118]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x4a
call fcn.00453ee0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
mov ecx, edi
call fcn.00484a10
push 0x7c
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x4b
test eax, eax
je 0x473ae5
push eax
call fcn.0046a9e0
mov edi, eax
jmp 0x473ae7
xor edi, edi
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov edx, dword [ebx + ecx*4 + 0x80]
mov eax, dword [edi]
mov eax, dword [eax + 0x160]
push 0xfffd
push edx
mov edx, dword [ebp - 0x8c]
lea ecx, [ebp - 0x20]
push ecx
push 0x54000003
push edx
mov ecx, edi
call eax
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x473b4b
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x473b43
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x473b4b
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea ecx, [ebp - 0x80]
push ecx
push 4
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 4
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 4
call fcn.0046fc50
jmp 0x474826
lea ecx, [ebp - 0xa4]
push 0x5ee45c
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x473d1c
lea ecx, [ebp - 0xd8]
call fcn.0048e51d
lea edx, [ebp - 0x120]
mov bl, 0x4c
push edx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x4d
call fcn.00453ee0
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], bl
call fcn.00453f70
lea eax, [ebp - 0xd8]
push eax
lea ebx, [ebp - 0x80]
call fcn.00488cc0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, ebx
call fcn.00484a10
push 0x80
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x4e
test eax, eax
je 0x473c2b
mov esi, eax
call fcn.0046ac10
mov edi, eax
jmp 0x473c2d
xor edi, edi
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x4c
mov eax, dword [ebp - 0x94]
mov eax, dword [eax + ecx*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0xffff
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x54200002
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x473c8e
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x473c86
push 0xc
call ebx
test eax, eax
je 0x473c8e
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
mov eax, dword [ebp - 0xd0]
xor esi, esi
test eax, eax
jle 0x473cd0
test esi, esi
js 0x47497c
cmp esi, eax
jge 0x47497c
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax + esi*4]
push eax
mov ecx, edi
call fcn.004533e0
mov eax, dword [ebp - 0xd0]
inc esi
cmp esi, eax
jl 0x473ca4
lea ecx, [ebp - 0x80]
push ecx
push 5
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 5
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
push 5
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
call fcn.0046fc50
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x39
call fcn.0048e75b
jmp 0x474820
lea ecx, [ebp - 0xa4]
push 0x5ee464
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x473ed1
lea ecx, [ebp - 0xd8]
call fcn.0048e51d
lea edx, [ebp - 0x128]
mov bl, 0x4f
push edx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x50
call fcn.00453ee0
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], bl
call fcn.00453f70
lea edi, [ebp - 0x80]
lea ecx, [ebp - 0x130]
call fcn.00484730
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 0x51
call fcn.00453ee0
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], bl
call fcn.00453f70
lea eax, [ebp - 0xd8]
push eax
mov ebx, edi
call fcn.00488cc0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, edi
call fcn.00484a10
push 0x1ec
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x52
test eax, eax
je 0x473ddf
push eax
call fcn.0046c7e0
mov edi, eax
jmp 0x473de1
xor edi, edi
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x4f
mov eax, dword [ebp - 0x94]
mov eax, dword [eax + ecx*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0xffff
push eax
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x20]
push ecx
push 0x54800120
push eax
mov ecx, edi
call edx
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, edi
call fcn.0048d6f7
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x473e57
mov ebx, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call ebx
test eax, eax
jne 0x473e4f
push 0xc
call ebx
test eax, eax
je 0x473e57
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
mov eax, dword [ebp - 0xd0]
xor esi, esi
test eax, eax
jle 0x473ea5
lea ecx, [ecx]
test esi, esi
js 0x47497c
cmp esi, eax
jge 0x47497c
mov ecx, dword [ebp - 0xd4]
mov edx, dword [edi]
push 0xffffffffffffffff
lea eax, [ecx + esi*4]
push 0
push eax
mov eax, dword [edx + 0x168]
mov ecx, edi
call eax
mov eax, dword [ebp - 0xd0]
inc esi
cmp esi, eax
jl 0x473e70
lea ecx, [ebp - 0x80]
push ecx
push 7
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 7
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
call fcn.00487ad0
push 7
jmp 0x473cf7
lea ecx, [ebp - 0xa4]
push 0x5ee46c
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x473fde
lea edx, [ebp - 0x138]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x53
call fcn.00453ee0
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x78
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x54
test eax, eax
je 0x473f4a
mov esi, eax
call fcn.0046de40
mov edi, eax
jmp 0x473f4c
xor edi, edi
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0x10001
push ecx
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x473fa9
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x473fa1
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x473fa9
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 8
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 8
call fcn.0046fc50
jmp 0x474826
lea ecx, [ebp - 0xa4]
push 0x5ee474
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x4740eb
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x55
call fcn.00453ee0
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x78
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x56
test eax, eax
je 0x474057
mov esi, eax
call fcn.0046ae70
mov edi, eax
jmp 0x474059
xor edi, edi
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0xffff
push ecx
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4740b6
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x4740ae
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4740b6
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 9
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 9
call fcn.0046fc50
jmp 0x474826
lea ecx, [ebp - 0xa4]
push 0x5ee47c
push ecx
call fcn.00453500
add esp, 8
test al, al
je 0x474209
lea edx, [ebp - 0x148]
push edx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x57
call fcn.00453ee0
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x7c
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x58
test eax, eax
je 0x474163
push eax
call fcn.0046e0b0
mov edi, eax
jmp 0x474165
xor edi, edi
mov eax, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push 0x10003
push ecx
lea eax, [ebp - 0x20]
push eax
push 0x54000000
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4741c2
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x4741ba
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4741c2
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xb
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xb
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xb
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push 0x5ee484
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x47432f
lea ecx, [ebp - 0x150]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x59
call fcn.00453ee0
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0xb4
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x5a
test eax, eax
je 0x474284
push eax
call fcn.0046cca0
mov edi, eax
jmp 0x474286
xor edi, edi
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov edx, dword [ebx + ecx*4 + 0x80]
mov eax, dword [edi]
push 0xffff
push edx
mov edx, dword [eax + 0x160]
lea ecx, [ebp - 0x20]
push ecx
push 0x5400010e
push 0x5ee484
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x4742e8
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x4742e0
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x4742e8
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xa
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xa
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xa
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push str.OmFh
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x474456
lea ecx, [ebp - 0x158]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x5b
call fcn.00453ee0
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0xc4
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x5c
test eax, eax
je 0x4743aa
push eax
call fcn.0046cab0
mov edi, eax
jmp 0x4743ac
xor edi, edi
mov eax, dword [ebp - 0x98]
push 0x9ffcf
mov byte [ebp - 4], 0x39
mov ecx, dword [ebx + eax*4 + 0x80]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x54800080
mov ecx, edi
call fcn.0048e356
push 0
push 0
mov ecx, edi
call fcn.0048f5a5
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x47440f
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x474407
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x47440f
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xc
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0xc
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xc
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push 0x5ee49c
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x474598
lea ecx, [ebp - 0x160]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x5d
call fcn.00453ee0
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x88
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x5e
test eax, eax
je 0x4744d1
push eax
call fcn.0046c410
mov edi, eax
jmp 0x4744d3
xor edi, edi
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov edx, dword [ebx + ecx*4 + 0x80]
mov eax, dword [edi]
push 0xffff
push edx
mov edx, dword [eax + 0x160]
lea ecx, [ebp - 0x20]
push ecx
push 0x54000000
mov ecx, edi
call edx
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x474530
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
jne 0x474528
push 0xc
call dword [sym.imp.GDI32.dll_GetStockObject]
test eax, eax
je 0x474530
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, edi
call fcn.00453460
lea eax, [ebp - 0x80]
push eax
push 0xf
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
movzx ecx, word [edi + 0x84]
movzx edx, word [edi + 0x82]
push ecx
push edx
push edi
call fcn.004533b0
xor edx, edx
xor ecx, ecx
mov esi, edi
call fcn.0046c5d0
push 0xf
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0xf
call fcn.0046fc50
jmp 0x474826
lea edx, [ebp - 0xa4]
push str.OmhV
push edx
call fcn.00453500
add esp, 8
test al, al
je 0x474689
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x5f
call fcn.00453ee0
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x170
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x60
test eax, eax
je 0x474614
mov esi, eax
call fcn.00480080
mov edi, eax
jmp 0x474616
xor edi, edi
mov eax, dword [ebp - 0x88]
mov byte [ebp - 4], 0x39
mov edx, dword [edi]
mov edx, dword [edx + 0x160]
push eax
push 0x68
mov ecx, edi
call edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 1
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x20]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, edi
call fcn.0048d782
lea eax, [ebp - 0x80]
push eax
push 0x10
mov edx, edi
lea ecx, [ebp - 0xb8]
call fcn.00485020
push 0x10
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xb8]
push edx
call fcn.00487ad0
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
push 0x10
call fcn.0046fc50
jmp 0x474826
lea eax, [ebp - 0xa4]
push 0x5ee4ac
push eax
call fcn.00453500
add esp, 8
test al, al
je 0x474826
lea ecx, [ebp - 0x170]
push ecx
lea ecx, [ebp - 0x80]
call fcn.004845d0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x61
call fcn.00453ee0
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0x39
call fcn.00453f70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x80]
call fcn.00484a10
push 0x4bc
call fcn.004896de
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x62
test eax, eax
je 0x474704
push eax
call fcn.00457600
mov ebx, eax
jmp 0x474706
xor ebx, ebx
mov ecx, dword [ebp - 0x98]
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x94]
mov edx, dword [eax + ecx*4 + 0x80]
push edx
lea ecx, [ebp - 0x20]
mov edx, ebx
call fcn.00458000
mov ecx, dword [ebp - 0x88]
call fcn.00453490
mov esi, eax
test esi, esi
jne 0x474757
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push 0x11
call edi
test eax, eax
jne 0x47474f
push 0xc
call edi
test eax, eax
je 0x474757
push eax
call fcn.0048c6a6
mov esi, eax
push 1
push esi
mov ecx, ebx
call fcn.00453460
mov eax, dword [ebx + 0x164]
mov edx, dword [eax + 0x24]
lea ecx, [ebx + 0x164]
push 0xe0ffff
call edx
mov eax, ebx
call fcn.0045f380
push 0xf
mov dword [ebx + 0x9c], 0
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, eax
mov esi, ebx
call fcn.0044ec30
lea eax, [ebp - 0x80]
push eax
push 0x11
mov edx, ebx
lea ecx, [ebp - 0xb8]
call fcn.00485020
cmp dword [ebx + 0x118], 0
jne 0x4747f7
xor esi, esi
cmp dword [ebx + 0x120], esi
jle 0x4747f7
nop
test esi, esi
js 0x4747ee
cmp esi, dword [ebx + 0x120]
jge 0x4747ee
cmp esi, dword [ebx + 0x138]
jge 0x47497c
mov ecx, dword [ebx + 0x134]
lea eax, [ecx + esi*4]
mov ecx, ebx
mov dword [eax], 0x19
call fcn.0045d630
inc esi
cmp esi, dword [ebx + 0x120]
jl 0x4747c0
push 0x11
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0xb8]
push eax
mov edi, ebx
call fcn.00487ad0
push 0x11
mov esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x90]
mov edi, ebx
call fcn.0046fc50
mov ebx, dword [ebp - 0x94]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x38
call fcn.00453f70
lea ecx, [ebp - 0x80]
push 0x5ee4e0
push ecx
call fcn.00452f50
add esp, 8
test al, al
jne 0x47319e
inc dword [ebp - 0x98]
lea ecx, [ebp - 0xc0]
call fcn.00453f70
lea ecx, [ebp - 0xbc]
call fcn.00453f70
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 6
call fcn.00453f70
lea edx, [ebp - 0x80]
push 0x5ee4bc
push edx
call fcn.00452f50
add esp, 8
test al, al
jne 0x473020
mov esi, ebx
call fcn.0046ed20
mov eax, ebx
call fcn.0046eb60
push 0
dec eax
push eax
mov eax, dword [ebx + 0x20]
push 0x130c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, ebx
call fcn.0046eb60
dec eax
push eax
mov edi, ebx
call fcn.0046ec50
mov ebx, dword [ebp - 0x88]
lea ecx, [ebp - 0xb8]
push ecx
lea esi, [ebp - 0x80]
call fcn.00484310
lea edx, [ebp - 0xdc]
push edx
mov ecx, esi
call fcn.00484420
mov byte [ebp - 4], 0x63
mov ecx, dword [eax]
mov esi, dword [ebp - 0x9c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x47494d
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47493d
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47493d
push eax
call fcn.00453e70
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47492c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x9c], ebx
mov ebx, dword [ebp - 0x88]
jmp 0x47494d
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x9c]
call fcn.00453d90
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xdc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x471460
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x471460
call fcn.0048a0e3
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4749a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4749cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4749ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x474a10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x474a27
push eax
call fcn.00489718
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x474a4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x474a70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005909d4
mov esp, ebp
pop ebp
ret 0xc