Function at 0x41d050
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4a9bf0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c0], esi
mov dword [ebp - 0x170], 0
mov ecx, dword [esi + 0x24]
sub ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x20]
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x168], ecx
xor ecx, ecx
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x164], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f8], ecx
cmp dword [0x4bd734], ecx
je 0x41e5d6
cmp dword [eax], 0x12345678
jne 0x41e5d6
call fcn.0043c990
push dword [esi + 0x18]
mov edi, eax
mov dword [ebp - 0x1b4], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov eax, dword [0x4bd734]
mov dword [ebp - 0x1c8], ebx
cmp dword [eax + 0xdd0], 0
je 0x41d118
push 0
push dword [eax + 0xdcc]
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebx
mov dword [ebp - 0x1f8], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ecx, dword [ebp - 0x1dc]
push ecx
push dword [ebp - 0x1e8]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [ebp - 0x17c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x4bd734]
mov dword [ebp - 0x208], eax
test dword [ecx + 4], 0x8000
je 0x41d159
mov eax, dword [edi + 0x188]
jmp 0x41d161
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1bc]
test eax, eax
je 0x41d18e
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x4bd734]
mov dword [ebp - 0x170], 0x18
test dword [eax + 4], 0x8000
je 0x41d427
mov ecx, dword [edi + 0x188]
movzx eax, cl
movsd xmm2, qword [0x480d38]
mov dword [ebp - 0x170], 0x1a
movd xmm4, eax
shr eax, 0x1f
cvtdq2pd xmm4, xmm4
addsd xmm4, qword [eax*8 + 0x4801d0]
mov eax, ecx
shr ecx, 0x10
shr eax, 8
movzx eax, al
movd xmm3, eax
shr eax, 0x1f
cvtdq2pd xmm3, xmm3
addsd xmm3, qword [eax*8 + 0x4801d0]
movzx eax, cl
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x4801d0]
movaps xmm0, xmm1
mulsd xmm0, xmm2
subsd xmm1, xmm0
movaps xmm0, xmm3
mulsd xmm0, xmm2
cvttsd2si ecx, xmm1
subsd xmm3, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
shl ecx, 8
cvttsd2si eax, xmm3
subsd xmm4, xmm0
or ecx, eax
shl ecx, 8
cvttsd2si eax, xmm4
or ecx, eax
movzx eax, cl
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4801d0]
mov eax, ecx
shr ecx, 0x10
shr eax, 8
movzx eax, al
movsd qword [ebp - 0x1f4], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4801d0]
movzx eax, cl
movsd qword [ebp - 0x200], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4801d0]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x160]
push eax
movsd qword [ebp - 0x178], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x158], eax
mov eax, dword [0x4bd734]
mov dword [ebp - 0x160], 0
cmp dword [eax + 0xdd0], 0
jne 0x41d3cc
mov edx, dword [0x4bd744]
test edx, edx
je 0x41d3cc
mov eax, dword [ebp - 0x15c]
movzx ecx, word [edi + 0x188]
mov dword [ebp - 0x14c], eax
mov eax, ecx
shl eax, 8
and ecx, 0xff00
mov word [ebp - 0x148], ax
movzx eax, byte [edi + 0x18a]
shl ax, 8
mov word [ebp - 0x144], ax
xor eax, eax
mov word [ebp - 0x142], ax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x13c], eax
cvttsd2si eax, qword [ebp - 0x1f4]
mov dword [ebp - 0x150], 0
mov word [ebp - 0x146], cx
shl ax, 8
mov word [ebp - 0x138], ax
cvttsd2si eax, qword [ebp - 0x200]
shl ax, 8
mov word [ebp - 0x136], ax
cvttsd2si eax, qword [ebp - 0x178]
mov dword [ebp - 0x174], 1
shl ax, 8
mov word [ebp - 0x134], ax
xor eax, eax
mov word [ebp - 0x132], ax
mov dword [ebp - 0x178], eax
test ebx, ebx
je 0x41d420
push eax
push 1
lea eax, [ebp - 0x178]
push eax
push 2
lea eax, [ebp - 0x150]
push eax
push ebx
call edx
jmp 0x41d420
cvttsd2si eax, qword [ebp - 0x178]
movzx ecx, al
cvttsd2si eax, qword [ebp - 0x200]
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, qword [ebp - 0x1f4]
shl ecx, 8
movzx eax, al
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, eax
lea eax, [ebp - 0x160]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
test edi, edi
je 0x41d420
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
add dword [ebp - 0x170], 3
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ecx + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [ebp - 0x1e0], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1b8], eax
and eax, 1
mov dword [ebp - 0x1e4], edi
mov dword [ebp - 0x1d0], eax
call fcn.0043c990
movsd xmm2, qword [0x480d68]
xorps xmm3, xmm3
mov ecx, dword [eax + 0x184]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, edx
movzx esi, cl
shr eax, 0x1f
shr ecx, 0x10
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movzx ecx, cl
movd xmm4, ecx
addsd xmm0, qword [eax*8 + 0x4801d0]
mov eax, esi
movd xmm5, edx
shr eax, 0x1f
cvtdq2pd xmm4, xmm4
shr edx, 0x1f
cvtpd2ps xmm0, xmm0
cvtdq2pd xmm5, xmm5
cvtps2pd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x480dd0]
addsd xmm0, qword [eax*8 + 0x4801d0]
mov eax, ecx
movd xmm6, esi
shr eax, 0x1f
addsd xmm5, qword [edx*8 + 0x4801d0]
cvtdq2pd xmm6, xmm6
shr esi, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm6, qword [esi*8 + 0x4801d0]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x480da0]
addsd xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm4, qword [ecx*8 + 0x4801d0]
addsd xmm0, qword [eax*8 + 0x4801d0]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x480d50]
addsd xmm1, xmm0
movsd xmm0, qword [0x480e50]
cvttsd2si eax, xmm1
movzx eax, al
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x480d48]
addsd xmm1, qword [0x480e40]
subsd xmm0, xmm1
movsd xmm1, qword [0x480e18]
subsd xmm1, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
maxsd xmm3, xmm1
movsd xmm1, qword [0x480e38]
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x480dc0]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x480e28]
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x204], ecx
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x480da8]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x480e30]
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x174], ecx
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movzx eax, al
or ecx, eax
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x1fc], ecx
je 0x41d6bd
mov eax, dword [ebp - 0x1b4]
push 0xffffffffffffffe0
push dword [eax + 0x188]
call fcn.00411840
add esp, 8
mov dword [ebp - 0x1bc], eax
jmp 0x41d710
movsd xmm1, qword [0x480df0]
movsd xmm0, qword [0x480d80]
mulsd xmm4, xmm1
mulsd xmm5, xmm1
mulsd xmm6, xmm1
addsd xmm4, xmm0
addsd xmm5, xmm0
addsd xmm6, xmm0
cvttsd2si eax, xmm4
movzx ecx, al
cvttsd2si eax, xmm5
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, xmm6
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [ebp - 0x1bc], ecx
mov esi, dword [ebp - 0x1c0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1a8], xmm0
movlpd qword [ebp - 0x1a0], xmm0
movlpd qword [ebp - 0x198], xmm0
mov eax, dword [esi + 8]
movlpd qword [ebp - 0x190], xmm0
movlpd qword [ebp - 0x188], xmm0
mov dword [ebp - 0x1ac], 0x11
mov dword [ebp - 0x1b0], 0x30
cmp eax, 0xffffffff
jne 0x41d771
lea eax, [ebp - 0x1b0]
push eax
mov eax, dword [ebp - 0x1ec]
push 1
push dword [eax + 4]
jmp 0x41d77b
lea ecx, [ebp - 0x1b0]
push ecx
push 0
push eax
push dword [ebp - 0x1e0]
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
test dword [ebp - 0x1a8], 0x800
je 0x41d7a3
test byte [ebp - 0x1a4], 0x10
jne 0x41d7a3
mov eax, 1
jmp 0x41d7a5
xor eax, eax
mov ecx, dword [0x4bd734]
mov edx, dword [ebp - 0x170]
test dword [ecx + 4], 0x8000
je 0x41d7c3
add edx, 2
mov dword [ebp - 0x170], edx
test eax, eax
je 0x41d836
mov eax, dword [ebp - 0x168]
add eax, 0xfffffffe
mov dword [ebp - 0x160], 2
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], 4
test dword [ecx + 4], 0x8000
je 0x41d81f
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x160], edx
push dword [eax + 0xc]
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x41e3b7
push 2
push 6
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x41e3b7
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x158], 0x14
mov dword [ebp - 0x154], 0x13
lea eax, [edx - 0x10]
mov dword [ebp - 0x1cc], 3
sar eax, 1
mov dword [ebp - 0x1d4], eax
lea eax, [edx - 0x14]
sar eax, 1
mov dword [ebp - 0x15c], eax
test dword [ecx + 4], 0x8000
je 0x41d8aa
push 0
push 1
lea eax, [ebp - 0x160]
mov dword [ebp - 0x1cc], 4
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
inc dword [ebp - 0x154]
mov ecx, dword [0x4bd734]
test byte [ebp - 0x1b8], 2
mov eax, dword [edi + 0x48]
jne 0x41d8d7
test eax, 0x20000
jne 0x41d8d7
mov edx, dword [ebp - 0x1b4]
mov esi, dword [edx + 0x18c]
mov dword [ebp - 0x1d8], esi
mov esi, dword [ebp - 0x1c0]
jmp 0x41d8ef
mov edx, dword [ebp - 0x1b4]
mov edi, dword [edx + 0x190]
mov dword [ebp - 0x1d8], edi
mov edi, dword [ebp - 0x1e4]
cmp dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1c4], eax
je 0x41d9dd
test byte [esi + 0xc], 3
mov dword [ebp - 0x1c4], eax
je 0x41d9dd
test dword [ecx + 4], 0x8000
je 0x41da1c
push dword [ebp - 0x1bc]
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x1f0], eax
je 0x41d948
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x41d954
push dword [ebp - 0x204]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x1f0]
mov dword [ebp - 0x1c4], eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x1dc]
push 6
push 6
push ecx
mov ecx, dword [ebp - 0x1e8]
add ecx, 0xfffffffe
mov dword [ebp - 0x1f0], eax
push ecx
push 0
push 1
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
test byte [ebp - 0x1b8], 2
push dword [ebp - 0x1c4]
push ebx
je 0x41d9ad
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x41d9ba
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x48]
mov ecx, dword [0x4bd734]
mov dword [ebp - 0x1c4], eax
mov edx, dword [ebp - 0x1b4]
cmp dword [edi + 0x40], 0
je 0x41dd93
mov eax, dword [ebp - 0x1b8]
test al, 2
je 0x41dafe
mov eax, dword [edi + 0x40]
push 1
push dword [ebp - 0x1d4]
add eax, 2
push dword [ebp - 0x1cc]
push ebx
push eax
push dword [ecx + 0xe14]
jmp 0x41e05a
push dword [edx + 0x184]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
cmp dword [edi + 0x40], 0
mov dword [ebp - 0x1f0], eax
jne 0x41da3d
test byte [ebp - 0x1b8], 8
je 0x41da53
test dword [ebp - 0x1a8], 0x200
mov dword [ebp - 0x140], 0x15
je 0x41da5d
mov dword [ebp - 0x140], 0
mov ecx, dword [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x1dc]
push eax
push ebx
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x134], ecx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1f0]
test eax, eax
je 0x41da9f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test byte [ebp - 0x1b8], 2
mov eax, dword [edi + 0x48]
jne 0x41dadb
test eax, 0x20000
jne 0x41dadb
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0x18c]
xor ecx, 0xffffff
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [0x4bd734]
jmp 0x41d9e3
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0x190]
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [0x4bd734]
jmp 0x41d9e3
test dword [ebp - 0x1a8], 0x200
jne 0x41dd42
test dword [ecx + 4], 0x8000
je 0x41dbb4
test al, 8
je 0x41dd42
push dword [ebp - 0x1bc]
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
cmp dword [ebp - 0x1d0], 0
mov esi, eax
mov eax, dword [ebp - 0x1fc]
cmovne eax, dword [ebp - 0x174]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
mov edi, eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
push 0
push 0
inc ecx
push ecx
mov ecx, dword [ebp - 0x158]
add ecx, 2
push ecx
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [ebp - 0x1e4]
jmp 0x41dd3c
mov edx, dword [esi + 0x10]
and edx, 1
test al, 8
je 0x41dd14
test edx, edx
jne 0x41dd06
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x154]
mov ebx, eax
sub ecx, dword [ebp - 0x15c]
push 0xffffff
sub ecx, 3
push 0
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 3
push ecx
push 0
call fcn.00414cb0
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
push eax
sub ecx, 3
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 3
push ecx
push 0
call fcn.00414cb0
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov edx, dword [ebp - 0x15c]
sub ecx, edx
mov eax, dword [ebp - 0x158]
sub ecx, 3
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x160]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x15c]
sub eax, edx
mov ecx, dword [ebp - 0x160]
sub eax, 3
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ecx, dword [0x4bd734]
mov ebx, dword [ebp - 0x1c8]
mov edi, dword [ebp - 0x1e4]
push dword [ecx + 0xddc]
push dword [ecx + 0xde0]
jmp 0x41dd24
test edx, edx
je 0x41dd42
push dword [ecx + 0xde0]
push dword [ecx + 0xddc]
movups xmm0, xmmword [ebp - 0x160]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.0041b580
add esp, 0x1c
mov ecx, dword [0x4bd734]
mov edx, dword [edi + 0x40]
test edx, edx
je 0x41e060
test dword [edi + 0x48], 0x20000
mov esi, dword [ebp - 0x1c0]
je 0x41dd63
mov eax, 3
jmp 0x41dd6f
test byte [esi + 0x10], 9
mov eax, 0
setne al
push 1
push dword [ebp - 0x1d4]
dec edx
push dword [ebp - 0x1cc]
add eax, edx
push ebx
push eax
push dword [ecx + 0xe14]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
jmp 0x41e066
test dword [ebp - 0x1a8], 0x200
je 0x41de32
test byte [ebp - 0x1b8], 2
je 0x41ddc3
test eax, 0x20000
je 0x41ddbb
mov edx, dword [edx + 0x158]
jmp 0x41ddc9
mov edx, dword [edx + 0x14c]
jmp 0x41ddc9
mov edx, dword [edx + 0x148]
test byte [ebp - 0x1b8], 8
je 0x41de17
test byte [esi + 0x10], 1
je 0x41ddfc
test dword [ecx + 4], 0x8000
jne 0x41ddfc
push 1
push dword [ebp - 0x1d4]
mov eax, 0x2a
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x41e05a
push 1
push dword [ebp - 0x1d4]
mov eax, 0x29
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x41e05a
push 1
push dword [ebp - 0x1d4]
mov eax, 0x26
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x41e05a
test byte [ebp - 0x1b8], 8
je 0x41e060
test byte [ebp - 0x1b8], 2
jne 0x41de5d
mov dword [ebp - 0x1c4], eax
test eax, 0x20000
jne 0x41de5d
mov eax, dword [edx + 0x148]
jmp 0x41de77
test dword [ebp - 0x1c4], 0x20000
je 0x41de71
mov eax, dword [edx + 0x158]
jmp 0x41de77
mov eax, dword [edx + 0x14c]
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
sub dword [ebp - 0x154], 2
sub dword [ebp - 0x158], 2
test dword [ecx + 4], 0x8000
mov dword [ebp - 0x1bc], eax
jne 0x41e016
test byte [esi + 0x10], 1
jne 0x41dfec
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x154]
mov ebx, eax
sub ecx, dword [ebp - 0x15c]
push 0xffffff
sub ecx, 2
push 0
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 2
push ecx
push 0
call fcn.00414cb0
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
push eax
sub ecx, 2
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 2
push ecx
push 0
call fcn.00414cb0
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov edx, dword [ebp - 0x15c]
sub ecx, edx
mov eax, dword [ebp - 0x158]
sub ecx, 2
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x160]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x15c]
sub eax, edx
mov ecx, dword [ebp - 0x160]
sub eax, 2
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ecx, dword [0x4bd734]
mov ebx, dword [ebp - 0x1c8]
mov edi, dword [ebp - 0x1e4]
push dword [ecx + 0xddc]
movups xmm0, xmmword [ebp - 0x160]
push dword [ecx + 0xde0]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.0041b580
mov ecx, dword [0x4bd734]
add esp, 0x1c
test dword [edi + 0x48], 0x20000
jne 0x41e03f
test byte [ebp - 0x1b8], 2
jne 0x41e03f
cmp dword [ebp - 0x1d0], 0
je 0x41e03f
test dword [ecx + 4], 0x8000
mov eax, 0x28
je 0x41e044
mov eax, 0x27
push 1
push dword [ebp - 0x1d4]
push dword [ebp - 0x1cc]
push ebx
push eax
push dword [ebp - 0x1bc]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov esi, dword [ebp - 0x1c0]
test dword [edi + 0x48], 0x100000
je 0x41e0ec
xor ecx, ecx
mov dword [ebp - 0x1bc], edi
mov dword [ebp - 0x1c8], ecx
mov eax, edi
nop
cmp dword [eax], 0
je 0x41e0d5
test dword [edi + 0x48], 0x20000
jne 0x41e0a5
test byte [ebp - 0x1b8], 2
jne 0x41e0a5
test byte [esi + 0x10], 9
mov eax, 0
setne al
jmp 0x41e0aa
mov eax, 3
push 0xff00ff
push dword [ebp - 0x1d4]
add eax, ecx
push dword [ebp - 0x1cc]
push dword [edi + eax*4]
push ebx
call fcn.0041e6f0
mov ecx, dword [ebp - 0x1c8]
add esp, 0x14
mov eax, dword [ebp - 0x1bc]
add ecx, 4
add eax, 0x10
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1c8], ecx
cmp ecx, 0x10
jl 0x41e080
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
test dword [edi + 0x48], 0x1000000
mov eax, dword [ebp - 0x1b4]
je 0x41e10c
push dword [eax + 0x118]
jmp 0x41e112
push dword [eax + 0x2f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x41e148
lea edx, [ebp - 0x130]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x41e132
mov esi, dword [ebp - 0x1c0]
jmp 0x41e16b
mov esi, dword [ebp - 0x1c0]
lea eax, [ebp - 0x130]
push 0
push 0x12c
push eax
push dword [esi + 8]
push dword [ebp - 0x1e0]
call dword [sym.imp.USER32.dll_GetMenuStringA]
lea eax, [ebp - 0x130]
push 9
push eax
call fcn.0046e733
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x41e1dc
lea eax, [ebp - 0x130]
push 8
push eax
call fcn.0046e733
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x41e1dc
lea eax, [ebp - 0x130]
push 0xb
push eax
call fcn.0046e733
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x41e1dc
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e1c5
sub ecx, edx
lea eax, [ebp - 0x130]
add eax, ecx
mov dword [ebp - 0x1b4], eax
test dword [edi + 0x48], 0x20000
jne 0x41e1ee
test byte [ebp - 0x1b8], 2
je 0x41e253
cmp dword [ebp - 0x1d0], 0
jne 0x41e253
mov eax, dword [0x4bd734]
test dword [eax + 4], 0x8000
jne 0x41e253
movups xmm0, xmmword [ebp - 0x170]
push 1
push 1
lea eax, [ebp - 0x140]
push eax
movups xmmword [ebp - 0x140], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call eax
mov edx, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
push 0x24
lea eax, [ebp - 0x140]
sub edx, ecx
push eax
push edx
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x24
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
sub eax, ecx
push eax
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [ebp - 0x1b4]
mov al, byte [ecx]
cmp al, 0xb
jne 0x41e2af
mov eax, 0x51eb851f
imul dword [ebp - 0x170]
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
imul eax, eax, 0x19
mov dword [ebp - 0x170], eax
mov al, byte [ecx]
test al, al
je 0x41e3aa
sub dword [ebp - 0x168], 0x13
test dword [edi + 0x48], 0x20000
jne 0x41e2d4
test byte [ebp - 0x1b8], 2
je 0x41e374
cmp dword [ebp - 0x1d0], 0
jne 0x41e374
mov eax, dword [0x4bd734]
test dword [eax + 4], 0x8000
jne 0x41e374
movups xmm0, xmmword [ebp - 0x170]
push 1
push 1
lea eax, [ebp - 0x140]
push eax
movups xmmword [ebp - 0x140], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call eax
mov edx, dword [ebp - 0x1b4]
lea ecx, [edx + 1]
lea eax, [ecx + 1]
mov dword [ebp - 0x174], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e331
sub ecx, dword [ebp - 0x174]
xor eax, eax
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x140]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x1b4]
inc ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e378
sub ecx, edx
xor eax, eax
mov edx, dword [ebp - 0x1b4]
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x170]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1bc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebx
push dword [ebp - 0x1dc]
push dword [ebp - 0x1e8]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x1f8]
test eax, eax
je 0x41e3f0
push 0
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x208]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x17c]
test eax, eax
je 0x41e415
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x58]
test eax, eax
je 0x41e423
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp - 0x1d0], 0
mov dword [edi + 0x58], 0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x5c], eax
je 0x41e5c0
mov eax, dword [edi + 0x60]
test eax, eax
je 0x41e5c0
cmp byte [eax], 0
je 0x41e5c0
test dword [edi + 0x48], 0x800000
je 0x41e5c0
mov esi, dword [ebp - 0x1e0]
xor ebx, ebx
lea eax, [ebp - 0x160]
push eax
push ebx
push esi
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push esi
push 0
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
inc ebx
test eax, eax
js 0x41e466
lea ecx, [ebp - 0x160]
push ecx
mov ecx, dword [ebp - 0x1ec]
mov ecx, dword [ecx + 4]
sub ecx, eax
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
mov eax, dword [0x4bd9b8]
mov esi, dword [ebp - 0x1c0]
test eax, eax
jne 0x41e51f
cmp dword [0x4bd9bc], 0
jne 0x41e51f
push 0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
mov edi, eax
mov esi, dword [sym.imp.GDI32.dll_GetPixel]
add ecx, 0xfffffffd
push ecx
push edi
call esi
push dword [ebp - 0x15c]
mov dword [0x4bd9b8], eax
mov eax, dword [ebp - 0x160]
add eax, 0xfffffffe
push eax
push edi
call esi
push edi
push 0
mov dword [0x4bd9bc], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x4bd9b8]
mov edi, dword [ebp - 0x1e4]
mov esi, dword [ebp - 0x1c0]
mov edx, dword [edi + 0x60]
mov ecx, edx
mov dword [edi + 0x78], eax
mov eax, dword [0x4bd9bc]
mov dword [edi + 0x74], eax
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e532
lea eax, [ebp - 0x180]
sub ecx, ebx
push eax
push ecx
push edx
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x180]
add ecx, 2
add eax, 5
mov dword [ebp - 0x160], ecx
add eax, ecx
mov dword [ebp - 0x158], eax
mov eax, dword [0x4bd734]
push edi
push dword [eax + 0x10]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x154]
sub eax, edx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
add eax, 5
push eax
push edx
lea eax, [ecx - 5]
push eax
push 0x50000000
push dword [edi + 0x60]
push str.MenuToolTip
push 0x8080084
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [edi + 0x58], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046300c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046300c
mov esp, ebp
pop ebp
ret