Function at 0x4bc7b0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x50dc10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
lea eax, [edi + 0x1c]
mov dword [ebp - 0x1c0], edi
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x178], 0
mov ecx, dword [edi + 0x24]
sub ecx, dword [eax]
mov eax, dword [edi + 0x28]
sub eax, dword [edi + 0x20]
mov ebx, dword [edi + 0x2c]
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x16c], eax
xor eax, eax
mov dword [ebp - 0x1f4], ecx
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x1f8], ebx
mov dword [ebp - 0x208], eax
call fcn.00493410
mov esi, eax
xor eax, eax
cmp dword [0x58fbfc], eax
mov dword [ebp - 0x1bc], esi
sete al
mov dword [ebp - 0x204], eax
test esi, esi
je 0x4bdf3b
cmp dword [ebx], 0x12345678
jne 0x4bdf3b
call fcn.004d0500
push dword [edi + 0x18]
mov dword [ebp - 0x1b4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp dword [esi + 0xdd0], 0
mov ebx, eax
mov dword [ebp - 0x1d8], ebx
je 0x4bc893
push 0
push dword [esi + 0xdcc]
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebx
mov dword [ebp - 0x208], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ecx, dword [ebp - 0x1e8]
push ecx
push dword [ebp - 0x1f4]
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [ebp - 0x17c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x210], eax
test ecx, 0x8000
je 0x4bc8e5
mov edi, dword [ebp - 0x1b4]
test ecx, 0x40000
je 0x4bc8dd
mov eax, 0xf9f9f9
jmp 0x4bc8f3
mov eax, dword [edi + 0x188]
jmp 0x4bc8f3
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
mov edi, dword [ebp - 0x1b4]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [ebp - 0x1d0], eax
lea eax, [ebp - 0x178]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x4bc920
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0x178]
add edx, 0x18
mov dword [ebp - 0x178], edx
mov eax, dword [esi + 4]
test eax, 0x8000
je 0x4bcb78
test eax, 0x40000
je 0x4bc94b
mov eax, 0xf0f0f0
jmp 0x4bc961
push 0xfffffffffffffff0
push dword [edi + 0x188]
call fcn.004852f0
mov edx, dword [ebp - 0x178]
add esp, 8
movzx ecx, al
add edx, 2
mov dword [ebp - 0x1cc], eax
shr eax, 8
movzx eax, al
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
mov dword [ebp - 0x178], edx
addsd xmm0, qword [ecx*8 + 0x4f4e60]
movsd qword [ebp - 0x200], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f4e60]
mov eax, dword [ebp - 0x1cc]
shr eax, 0x10
movzx eax, al
movsd qword [ebp - 0x1d4], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f4e60]
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x160]
push eax
movsd qword [ebp - 0x168], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
test dword [esi + 4], 0x40000
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x160], 0
jne 0x4bcb62
cmp dword [esi + 0xdd0], 0
jne 0x4bcb0e
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.004a23e0
test eax, eax
je 0x4bcb0e
mov eax, dword [ebp - 0x160]
movzx ecx, word [edi + 0x188]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x14c], eax
mov eax, ecx
shl eax, 8
and ecx, 0xff00
mov word [ebp - 0x148], ax
movzx eax, byte [edi + 0x18a]
shl ax, 8
mov word [ebp - 0x144], ax
xor eax, eax
mov word [ebp - 0x142], ax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x13c], eax
cvttsd2si eax, qword [ebp - 0x200]
mov word [ebp - 0x146], cx
shl ax, 8
mov word [ebp - 0x138], ax
cvttsd2si eax, qword [ebp - 0x1d4]
shl ax, 8
mov word [ebp - 0x136], ax
cvttsd2si eax, qword [ebp - 0x168]
mov dword [ebp - 0x164], 1
shl ax, 8
mov word [ebp - 0x134], ax
xor eax, eax
push eax
push 1
mov word [ebp - 0x132], ax
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x168]
push eax
push 2
lea eax, [ebp - 0x150]
push eax
push ebx
call fcn.004a23e0
jmp 0x4bcb62
cvttsd2si eax, qword [ebp - 0x168]
movzx ecx, al
cvttsd2si eax, qword [ebp - 0x1d4]
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, qword [ebp - 0x200]
shl ecx, 8
movzx eax, al
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, eax
lea eax, [ebp - 0x160]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
test edi, edi
je 0x4bcb62
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 4]
and eax, 0x40000
or eax, 0xa0000
shr eax, 0x11
add dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x1f8]
mov eax, dword [ecx + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1cc], edi
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1b8], eax
and eax, 1
mov dword [ebp - 0x1e4], eax
call fcn.004d0500
xorps xmm6, xmm6
mov ecx, dword [eax + 0x184]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, edx
movzx esi, cl
shr eax, 0x1f
shr ecx, 0x10
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movzx ecx, cl
movd xmm3, ecx
addsd xmm0, qword [eax*8 + 0x4f4e60]
mov eax, esi
movd xmm4, edx
shr eax, 0x1f
movd xmm5, esi
cvtdq2pd xmm3, xmm3
shr edx, 0x1f
cvtpd2ps xmm0, xmm0
cvtdq2pd xmm4, xmm4
cvtps2pd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
shr esi, 0x1f
mulsd xmm1, qword [0x4e5a60]
addsd xmm0, qword [eax*8 + 0x4f4e60]
mov eax, ecx
shr eax, 0x1f
addsd xmm4, qword [edx*8 + 0x4f4e60]
cvtdq2pd xmm5, xmm5
cvtpd2ps xmm0, xmm0
addsd xmm5, qword [esi*8 + 0x4f4e60]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4e5a30]
addsd xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm3, qword [ecx*8 + 0x4f4e60]
addsd xmm0, qword [eax*8 + 0x4f4e60]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4e59d8]
addsd xmm1, xmm0
movsd xmm0, qword [0x4e5ae8]
cvttsd2si eax, xmm1
movzx eax, al
movd xmm1, eax
mov eax, dword [ebp - 0x1bc]
cvtdq2pd xmm1, xmm1
mov eax, dword [eax + 4]
and eax, 0x40000
mov dword [ebp - 0x1fc], eax
mulsd xmm1, qword [0x4e59d0]
addsd xmm1, qword [0x4e5ad8]
subsd xmm0, xmm1
movsd xmm1, qword [0x4e5ab0]
subsd xmm1, xmm0
maxsd xmm6, xmm1
test eax, eax
je 0x4bcce6
mov dword [ebp - 0x1f0], 0xe8e8e8
mov dword [ebp - 0x1d0], 0xc4c4c4
jmp 0x4bcdb6
movsd xmm2, qword [0x4e59f0]
movaps xmm0, xmm3
movsd xmm1, qword [0x4e5ad0]
mulsd xmm0, xmm2
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x4e5a58]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x4e5ac0]
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movaps xmm0, xmm3
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x1f0], ecx
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movzx eax, al
or ecx, eax
mov dword [ebp - 0x1d0], ecx
movsd xmm2, qword [0x4e5a38]
movaps xmm0, xmm3
movsd xmm1, qword [0x4e5ac8]
mulsd xmm0, xmm2
mov esi, dword [ebp - 0x1fc]
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si edx, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
mov dword [ebp - 0x1c8], eax
addsd xmm0, xmm1
subsd xmm0, xmm6
cvttsd2si ecx, xmm0
test esi, esi
je 0x4bce1b
mov dword [ebp - 0x1fc], 0xd4d4d4
jmp 0x4bce48
movzx ecx, dl
or ecx, 0x200
movzx eax, al
shl ecx, 8
or ecx, eax
cvttsd2si eax, xmm0
shl ecx, 8
movzx eax, al
or ecx, eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1fc], ecx
cvttsd2si ecx, xmm0
test byte [ebp - 0x1b8], 2
jne 0x4bce9f
test esi, esi
jne 0x4bcea3
movsd xmm1, qword [0x4e5a90]
movsd xmm0, qword [0x4e5a10]
mulsd xmm3, xmm1
mulsd xmm4, xmm1
mulsd xmm5, xmm1
addsd xmm3, xmm0
addsd xmm4, xmm0
addsd xmm5, xmm0
cvttsd2si eax, xmm3
movzx esi, al
cvttsd2si eax, xmm4
or esi, 0x200
shl esi, 8
movzx eax, al
or esi, eax
cvttsd2si eax, xmm5
movzx eax, al
jmp 0x4bcebe
test esi, esi
je 0x4bceaa
mov esi, 0xb0b0b0
jmp 0x4bcec3
movzx esi, dl
or esi, 0x200
movzx eax, al
shl esi, 8
or esi, eax
movzx eax, cl
shl esi, 8
or esi, eax
mov eax, dword [ebp - 0x1c0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1a8], xmm0
movlpd qword [ebp - 0x1a0], xmm0
movlpd qword [ebp - 0x198], xmm0
mov eax, dword [eax + 8]
movlpd qword [ebp - 0x190], xmm0
movlpd qword [ebp - 0x188], xmm0
mov dword [ebp - 0x1ac], 0x15
mov dword [ebp - 0x1b0], 0x30
cmp eax, 0xffffffff
jne 0x4bcf24
lea eax, [ebp - 0x1b0]
push eax
mov eax, dword [ebp - 0x1f8]
push 1
push dword [eax + 4]
jmp 0x4bcf2e
lea ecx, [ebp - 0x1b0]
push ecx
push 0
push eax
push dword [ebp - 0x1ec]
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
test dword [ebp - 0x1a8], 0x800
je 0x4bcff4
test byte [ebp - 0x1a4], 0x10
jne 0x4bcff4
mov esi, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0x170]
add ecx, 0xfffffffe
mov dword [ebp - 0x160], 2
mov dword [ebp - 0x15c], 3
mov eax, dword [esi + 4]
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], 4
test eax, 0x8000
je 0x4bcfdd
test eax, 0x40000
je 0x4bcfb5
push 0xe5e5e5
push 3
push ecx
push 3
push 2
push ebx
call fcn.004cc890
add esp, 0x18
jmp 0x4bdc53
mov ecx, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x160]
push dword [ecx + 0xc]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x4bdc53
push 2
push 6
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x4bdc53
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp - 0x1dc], 3
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x138], 0x14
lea eax, [ecx - 0x10]
mov dword [ebp - 0x134], 0x13
sar eax, 1
mov dword [ebp - 0x1c8], eax
lea eax, [ecx - 0x14]
sar eax, 1
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x1bc]
test dword [eax + 4], 0x8000
je 0x4bd06e
push 0
push 1
lea eax, [ebp - 0x140]
mov dword [ebp - 0x1dc], 4
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
inc dword [ebp - 0x134]
mov eax, dword [ebp - 0x1bc]
test byte [ebp - 0x1b8], 2
mov edx, dword [edi + 0x48]
jne 0x4bd090
test edx, 0x20000
jne 0x4bd090
mov ecx, dword [ebp - 0x1b4]
mov ecx, dword [ecx + 0x18c]
jmp 0x4bd0b1
test dword [eax + 4], 0x40000
je 0x4bd0a5
mov dword [ebp - 0x1e0], 0x9f9f9f
jmp 0x4bd0b7
mov ecx, dword [ebp - 0x1b4]
mov ecx, dword [ecx + 0x190]
mov dword [ebp - 0x1e0], ecx
cmp dword [ebp - 0x1e4], 0
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], edx
je 0x4bd224
test byte [ecx + 0xc], 3
mov dword [ebp - 0x1c4], edx
je 0x4bd224
test dword [eax + 4], 0x8000
je 0x4bd26a
mov eax, dword [ebp - 0x1f4]
add eax, 0xfffffffe
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x1e8]
push esi
push 1
dec eax
mov dword [ebp - 0x15c], 0
push 0
mov dword [ebp - 0x154], eax
call dword [sym.imp.GDI32.dll_CreatePen]
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x164], eax
jne 0x4bd14e
cmp dword [0x58fbfc], 0
jne 0x4bd14e
push dword [ebp - 0x1f0]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x4bd156
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebx
mov dword [ebp - 0x1f0], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x164]
mov dword [ebp - 0x1c4], eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [0x58fbfc], 0
mov dword [ebp - 0x164], eax
jne 0x4bd1ab
mov eax, dword [ebp - 0x1bc]
test dword [eax + 4], 0x40000
je 0x4bd1ab
push dword [ebp - 0x1f0]
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x4bd1d0
mov eax, dword [ebp - 0x154]
push 6
push 6
inc eax
push eax
push dword [ebp - 0x158]
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
test byte [ebp - 0x1b8], 2
push dword [ebp - 0x1c4]
mov dword [0x58fbfc], 0
push ebx
je 0x4bd1f2
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4bd1ff
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x164]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x48]
mov edx, eax
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1b4]
cmp dword [edi + 0x40], 0
je 0x4bd63d
mov edx, dword [ebp - 0x1b8]
test dl, 2
je 0x4bd353
mov eax, dword [edi + 0x40]
push 1
push dword [ebp - 0x1c8]
add eax, 2
push dword [ebp - 0x1dc]
push ebx
push eax
mov eax, dword [ebp - 0x1bc]
push dword [eax + 0xe14]
jmp 0x4bd905
mov eax, dword [ebp - 0x1b4]
push dword [eax + 0x184]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
cmp dword [edi + 0x40], 0
mov dword [ebp - 0x164], eax
jne 0x4bd291
test byte [ebp - 0x1b8], 8
je 0x4bd2a7
test dword [ebp - 0x1a8], 0x200
mov dword [ebp - 0x160], 0x15
je 0x4bd2b1
mov dword [ebp - 0x160], 0
mov ecx, dword [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x1e8]
push eax
push ebx
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x154], ecx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x4bd2f3
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test byte [ebp - 0x1b8], 2
mov edx, dword [edi + 0x48]
jne 0x4bd330
test edx, 0x20000
jne 0x4bd330
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], edx
mov ecx, dword [eax + 0x18c]
xor ecx, 0xffffff
mov dword [ebp - 0x1e0], ecx
mov ecx, dword [ebp - 0x1c0]
jmp 0x4bd22a
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], edx
mov ecx, dword [eax + 0x190]
mov dword [ebp - 0x1e0], ecx
mov ecx, dword [ebp - 0x1c0]
jmp 0x4bd22a
test dword [ebp - 0x1a8], 0x200
jne 0x4bd5d5
mov eax, dword [ebp - 0x1bc]
test dword [eax + 4], 0x8000
je 0x4bd440
test dl, 8
je 0x4bd5d1
push esi
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
cmp dword [ebp - 0x1e4], 0
mov esi, eax
mov eax, dword [ebp - 0x1fc]
cmovne eax, dword [ebp - 0x1d0]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
mov dword [ebp - 0x164], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp - 0x1bc]
mov dword [ebp - 0x1d0], eax
test dword [esi + 4], 0x40000
je 0x4bd3ea
mov ecx, dword [ebp - 0x134]
push 2
inc ecx
push 2
push ecx
mov ecx, dword [ebp - 0x138]
add ecx, 2
push ecx
jmp 0x4bd400
mov eax, dword [ebp - 0x134]
push 0
inc eax
push 0
push eax
mov eax, dword [ebp - 0x138]
add eax, 2
push eax
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
push dword [ebp - 0x164]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1d0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4bd5db
mov eax, dword [ecx + 0x10]
and eax, 1
test dl, 8
je 0x4bd5b9
test eax, eax
jne 0x4bd58d
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x134]
mov ebx, eax
sub ecx, dword [ebp - 0x13c]
push 0xffffff
sub ecx, 3
push 0
push ecx
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp - 0x140]
sub ecx, 3
push ecx
push 0
call fcn.00488d30
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x134]
sub ecx, dword [ebp - 0x13c]
push eax
sub ecx, 3
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp - 0x140]
sub ecx, 3
push ecx
push 0
call fcn.00488d30
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x134]
mov esi, eax
mov edx, dword [ebp - 0x13c]
sub ecx, edx
mov eax, dword [ebp - 0x138]
sub ecx, 3
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x140]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1d8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0x13c]
sub eax, edx
mov ecx, dword [ebp - 0x140]
sub eax, 3
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x138]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1d8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ebx, dword [ebp - 0x1d8]
mov edi, dword [ebp - 0x1cc]
mov esi, dword [ebp - 0x1bc]
push dword [esi + 0xddc]
push dword [esi + 0xde0]
movups xmm0, xmmword [ebp - 0x140]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.0048fad0
add esp, 0x1c
jmp 0x4bd5db
mov esi, dword [ebp - 0x1bc]
test eax, eax
je 0x4bd5db
push dword [esi + 0xde0]
push dword [esi + 0xddc]
jmp 0x4bd59f
mov esi, eax
jmp 0x4bd5db
mov esi, dword [ebp - 0x1bc]
mov ecx, dword [edi + 0x40]
test ecx, ecx
je 0x4bd90b
test dword [edi + 0x48], 0x20000
je 0x4bd5f6
mov eax, 2
jmp 0x4bd620
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax + 0x10]
test al, 8
jne 0x4bd61e
test al, 1
je 0x4bd619
test dword [esi + 4], 0x40000
je 0x4bd61e
cmp dword [ebp - 0x204], 0
jne 0x4bd61e
or eax, 0xffffffff
jmp 0x4bd620
xor eax, eax
push 1
push dword [ebp - 0x1c8]
add eax, ecx
push dword [ebp - 0x1dc]
push ebx
push eax
push dword [esi + 0xe14]
jmp 0x4bd905
test dword [ebp - 0x1a8], 0x200
je 0x4bd6e3
test byte [ebp - 0x1b8], 2
je 0x4bd66e
test edx, 0x20000
je 0x4bd666
mov edx, dword [eax + 0x158]
jmp 0x4bd674
mov edx, dword [eax + 0x14c]
jmp 0x4bd674
mov edx, dword [eax + 0x148]
test byte [ebp - 0x1b8], 8
je 0x4bd6c8
test byte [ecx + 0x10], 1
je 0x4bd6ad
mov eax, dword [ebp - 0x1bc]
test dword [eax + 4], 0x8000
jne 0x4bd6ad
push 1
push dword [ebp - 0x1c8]
mov eax, 0x2a
push dword [ebp - 0x1dc]
push ebx
push eax
push edx
jmp 0x4bd905
push 1
push dword [ebp - 0x1c8]
mov eax, 0x29
push dword [ebp - 0x1dc]
push ebx
push eax
push edx
jmp 0x4bd905
push 1
push dword [ebp - 0x1c8]
mov eax, 0x26
push dword [ebp - 0x1dc]
push ebx
push eax
push edx
jmp 0x4bd905
mov ecx, dword [ebp - 0x1b8]
test cl, 8
je 0x4bd911
test cl, 2
jne 0x4bd709
mov ecx, edx
test edx, 0x20000
jne 0x4bd70f
mov eax, dword [eax + 0x148]
jmp 0x4bd725
mov ecx, dword [ebp - 0x1c4]
test ecx, 0x20000
je 0x4bd71f
mov eax, dword [eax + 0x158]
jmp 0x4bd725
mov eax, dword [eax + 0x14c]
push 2
mov dword [ebp - 0x1c4], eax
lea eax, [ebp - 0x140]
push 2
push eax
call fcn.00489a40
mov esi, dword [ebp - 0x1bc]
add esp, 0xc
test dword [esi + 4], 0x8000
jne 0x4bd8c1
mov eax, dword [ebp - 0x1c0]
test byte [eax + 0x10], 1
jne 0x4bd89d
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x134]
mov ebx, eax
sub ecx, dword [ebp - 0x13c]
push 0xffffff
sub ecx, 2
push 0
push ecx
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp - 0x140]
sub ecx, 2
push ecx
push 0
call fcn.00488d30
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x134]
sub ecx, dword [ebp - 0x13c]
push eax
sub ecx, 2
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp - 0x140]
sub ecx, 2
push ecx
push 0
call fcn.00488d30
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x134]
mov esi, eax
mov edx, dword [ebp - 0x13c]
sub ecx, edx
mov eax, dword [ebp - 0x138]
sub ecx, 2
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x140]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1d8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0x13c]
sub eax, edx
mov ecx, dword [ebp - 0x140]
sub eax, 2
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x138]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1d8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ebx, dword [ebp - 0x1d8]
mov edi, dword [ebp - 0x1cc]
mov esi, dword [ebp - 0x1bc]
push dword [esi + 0xddc]
movups xmm0, xmmword [ebp - 0x140]
push dword [esi + 0xde0]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.0048fad0
add esp, 0x1c
test dword [edi + 0x48], 0x20000
jne 0x4bd8ea
test byte [ebp - 0x1b8], 2
jne 0x4bd8ea
cmp dword [ebp - 0x1e4], 0
je 0x4bd8ea
test dword [esi + 4], 0x8000
mov eax, 0x28
je 0x4bd8ef
mov eax, 0x27
push 1
push dword [ebp - 0x1c8]
push dword [ebp - 0x1dc]
push ebx
push eax
push dword [ebp - 0x1c4]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov ecx, dword [ebp - 0x1b8]
test dword [edi + 0x48], 0x100000
je 0x4bd98c
xor esi, esi
mov dword [ebp - 0x1d0], edi
mov eax, edi
cmp dword [eax], 0
je 0x4bd975
test dword [edi + 0x48], 0x20000
jne 0x4bd94b
test cl, 2
jne 0x4bd94b
mov eax, dword [ebp - 0x1c0]
test byte [eax + 0x10], 9
mov eax, 0
setne al
jmp 0x4bd950
mov eax, 3
push 0xff00ff
push dword [ebp - 0x1c8]
add eax, esi
push dword [ebp - 0x1dc]
push dword [edi + eax*4]
push ebx
call fcn.00491750
mov eax, dword [ebp - 0x1d0]
add esp, 0x14
mov ecx, dword [ebp - 0x1b8]
add eax, 0x10
add esi, 4
mov dword [ebp - 0x1d0], eax
cmp esi, 0x10
jl 0x4bd924
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
test dword [edi + 0x48], 0x1000000
mov eax, dword [ebp - 0x1b4]
je 0x4bd9ac
push dword [eax + 0x118]
jmp 0x4bd9b2
push dword [eax + 0x2f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4bd9e2
lea edx, [ebp - 0x130]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x4bd9d2
jmp 0x4bda05
push 0
push 0x12c
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0x1c0]
push dword [eax + 8]
push dword [ebp - 0x1ec]
call dword [sym.imp.USER32.dll_GetMenuStringA]
lea eax, [ebp - 0x130]
push 9
push eax
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x4bda77
lea eax, [ebp - 0x130]
push 8
push eax
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x4bda77
lea eax, [ebp - 0x130]
push 0xb
push eax
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__mbschr
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x4bda77
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bda60
sub ecx, edx
lea eax, [ebp - 0x130]
add eax, ecx
mov dword [ebp - 0x1b4], eax
test dword [edi + 0x48], 0x20000
jne 0x4bda89
test byte [ebp - 0x1b8], 2
je 0x4bdaf0
cmp dword [ebp - 0x1e4], 0
mov esi, dword [ebp - 0x1bc]
jne 0x4bdaf6
test dword [esi + 4], 0x8000
jne 0x4bdaf6
movups xmm0, xmmword [ebp - 0x178]
push 1
push 1
lea eax, [ebp - 0x160]
push eax
movups xmmword [ebp - 0x160], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
push 0xffffff
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
push 0x24
lea eax, [ebp - 0x160]
sub edx, ecx
push eax
push edx
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
jmp 0x4bdaf6
mov esi, dword [ebp - 0x1bc]
push dword [ebp - 0x1e0]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x24
lea eax, [ebp - 0x178]
push eax
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
sub eax, ecx
push eax
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [ebp - 0x1b4]
mov al, byte [ecx]
cmp al, 0xb
jne 0x4bdb52
mov eax, 0x51eb851f
imul dword [ebp - 0x178]
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
imul eax, eax, 0x19
mov dword [ebp - 0x178], eax
mov al, byte [ecx]
test al, al
je 0x4bdc46
sub dword [ebp - 0x170], 0x13
test dword [edi + 0x48], 0x20000
jne 0x4bdb77
test byte [ebp - 0x1b8], 2
je 0x4bdc0f
cmp dword [ebp - 0x1e4], 0
jne 0x4bdc0f
test dword [esi + 4], 0x8000
jne 0x4bdc0f
movups xmm0, xmmword [ebp - 0x178]
push 1
push 1
lea eax, [ebp - 0x160]
push eax
movups xmmword [ebp - 0x160], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov esi, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call esi
mov edx, dword [ebp - 0x1b4]
lea ecx, [edx + 1]
lea eax, [ecx + 1]
mov dword [ebp - 0x204], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bdbd0
sub ecx, dword [ebp - 0x204]
xor eax, eax
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x160]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1e0]
push ebx
call esi
mov ecx, dword [ebp - 0x1b4]
lea esi, [ecx + 1]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bdc17
sub ecx, edx
xor eax, eax
mov edx, dword [ebp - 0x1b4]
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x178]
push eax
push ecx
push esi
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
call fcn.00493410
mov esi, dword [sym.imp.USER32.dll_OffsetRect]
test dword [eax + 4], 0x40000
je 0x4bdcda
cmp dword [ebp - 0x19c], 0
je 0x4bdcda
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x174]
movaps xmm0, xmmword [0x4ea560]
cdq
sub eax, edx
sar eax, 1
sub eax, 8
push eax
mov eax, dword [ebp - 0x170]
add eax, 0xffffffef
push eax
lea eax, [ebp - 0x160]
push eax
movups xmmword [ebp - 0x160], xmm0
call esi
test byte [ebp - 0x1b8], 2
jne 0x4bdcbf
test dword [edi + 0x48], 0x20000
jne 0x4bdcbf
mov eax, 1
jmp 0x4bdcc1
xor eax, eax
movups xmm0, xmmword [ebp - 0x160]
push eax
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.004bc5a0
add esp, 0x18
call fcn.00493410
test dword [eax + 4], 0x40000
je 0x4bdcf4
push 3
push 3
push dword [ebp - 0x20c]
call esi
mov esi, dword [ebp - 0x1c0]
push 0xcc0020
push 0
push 0
push ebx
push dword [ebp - 0x1e8]
push dword [ebp - 0x1f4]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_BitBlt]
call fcn.00493410
test dword [eax + 4], 0x40000
je 0x4bdd42
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x4bdd56
push 0
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x210]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x17c]
test eax, eax
je 0x4bdd7b
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4bdd89
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp - 0x1e4], 0
mov dword [edi + 0x58], 0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x5c], eax
je 0x4bdf25
mov eax, dword [edi + 0x60]
test eax, eax
je 0x4bdf25
cmp byte [eax], 0
je 0x4bdf25
test dword [edi + 0x48], 0x800000
je 0x4bdf25
mov ebx, dword [sym.imp.USER32.dll_GetMenuItemRect]
xor esi, esi
mov edi, dword [ebp - 0x1ec]
lea eax, [ebp - 0x140]
push eax
push esi
push edi
push 0
call ebx
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push edi
push 0
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
inc esi
test eax, eax
js 0x4bddd2
lea ecx, [ebp - 0x140]
push ecx
mov ecx, dword [ebp - 0x1f8]
mov ecx, dword [ecx + 4]
sub ecx, eax
push ecx
push edi
push 0
call ebx
mov eax, dword [0x58fc44]
mov edi, dword [ebp - 0x1cc]
test eax, eax
jne 0x4bde7d
cmp dword [0x58fc48], 0
jne 0x4bde7d
push 0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
mov edi, eax
mov esi, dword [sym.imp.GDI32.dll_GetPixel]
add ecx, 0xfffffffd
push ecx
push edi
call esi
push dword [ebp - 0x13c]
mov dword [0x58fc44], eax
mov eax, dword [ebp - 0x140]
add eax, 0xfffffffe
push eax
push edi
call esi
push edi
push 0
mov dword [0x58fc48], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x58fc44]
mov edi, dword [ebp - 0x1cc]
mov edx, dword [edi + 0x60]
mov ecx, edx
mov dword [edi + 0x78], eax
mov eax, dword [0x58fc48]
mov dword [edi + 0x74], eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bde90
lea eax, [ebp - 0x180]
sub ecx, esi
push eax
mov eax, dword [ebp - 0x1c0]
push ecx
push edx
push dword [eax + 0x18]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebp - 0x138]
mov eax, dword [ebp - 0x180]
add ecx, 2
add eax, 5
mov dword [ebp - 0x140], ecx
add eax, ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x1bc]
push edi
push dword [eax + 0x10]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x134]
sub eax, edx
push eax
mov eax, dword [ebp - 0x138]
sub eax, ecx
add eax, 5
push eax
push edx
lea eax, [ecx - 5]
push eax
push 0x50000000
push dword [edi + 0x60]
push str.MenuToolTip
push 0x8080084
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [edi + 0x58], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e2538
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e2538
mov esp, ebp
pop ebp
ret