Function at 0x41eb30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4cb925
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x190]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x1ac]
mov edi, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a4]
mov ebp, dword [esp + 0x1a0]
xor esi, esi
cmp dword [ebp + 0x144], esi
mov dword [eax], esi
mov dword [eax + 4], esi
je 0x41eb90
mov eax, dword [ebp + 0x1a4]
jmp 0x41eb9d
push esi
mov eax, 0x4d97fc
mov ecx, ebp
call fcn.0041c080
lea ecx, [esp + 0xb4]
push str._body_
push ecx
mov ecx, edi
mov dword [esp + 0x58], eax
call fcn.004260f0
add esp, 8
push eax
mov ecx, edi
mov dword [esp + 0x19c], esi
call fcn.00406e20
mov dword [esp + 0x198], 0xffffffff
mov eax, dword [esp + 0xb4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41ebf5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 7
push str.__body_
mov ecx, edi
call fcn.00406ad0
mov ecx, dword [ebx + 4]
mov dword [ebp + 0x150], ecx
mov edx, dword [ebx]
mov dword [ebp + 0x14c], edx
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0x158], eax
mov eax, dword [ebx + 8]
mov dword [ebp + 0x154], eax
mov ecx, dword [ebx + 4]
mov esi, dword [ebx]
sub eax, edx
mov edx, dword [ebp + 0x170]
mov dword [esp + 0x28], ecx
push 0x4d97fc
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], edx
call fcn.00401f00
push 0x4d97fc
lea ecx, [esp + 0xa8]
mov dword [esp + 0x19c], 1
call fcn.00401f00
push 0x4d97fc
lea ecx, [esp + 0x24]
mov byte [esp + 0x19c], 2
call fcn.00401f00
push 0x4d97fc
lea ecx, [esp + 0x34]
mov byte [esp + 0x19c], 3
call fcn.00401f00
push 0x4d97fc
lea ecx, [esp + 0x38]
mov byte [esp + 0x19c], 4
call fcn.00401f00
push esi
mov ebx, ebp
mov byte [esp + 0x19c], 5
call fcn.004216c0
mov edx, dword [edi]
mov ecx, dword [ebp + 0xb4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x9c], eax
mov eax, dword [ebp + 0xc8]
mov dword [esp + 0x48], eax
mov eax, dword [edx - 0xc]
test eax, eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0xa0], 0
jle 0x420ccd
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0xa8]
push ecx
lea edx, [esp + 0xec]
push edx
mov ecx, edi
call fcn.00423440
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x19c], 6
call fcn.00406e20
mov byte [esp + 0x198], 5
mov eax, dword [esp + 0xe4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ed54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xe0]
push ecx
lea esi, [esp + 0xa8]
call fcn.004236f0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x19c], 7
call fcn.00406e20
mov byte [esp + 0x198], 5
mov eax, dword [esp + 0xe0]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41eda5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x2c]
cmp dword [ebx - 0xc], 0
je 0x41f307
mov eax, dword [ebp + 0xa0]
sub eax, 1
je 0x41ee74
sub eax, 1
je 0x41ee69
sub eax, 1
jne 0x41ee81
lea edi, [esp + 0x2c]
call fcn.00425d80
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
xor esi, esi
test eax, eax
jle 0x41ee81
mov edi, edi
test esi, esi
jl 0x420ead
cmp esi, eax
jg 0x420ead
movzx edx, word [ebx + esi*2]
movzx ecx, dx
cmp cx, 0x61
jb 0x41ee5d
cmp esi, eax
jg 0x420ead
movzx ecx, dx
cmp cx, 0x7a
ja 0x41ee5d
test esi, esi
je 0x41ee40
lea ecx, [esi - 1]
test ecx, ecx
jl 0x420ead
cmp ecx, eax
jg 0x420ead
movzx ecx, word [ebx + esi*2 - 2]
cmp cx, 0x20
jne 0x41ee5d
cmp esi, eax
jg 0x420ead
movzx eax, dx
add eax, 0xffffffe0
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.004262a0
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx - 0xc]
add esi, 1
cmp esi, eax
jl 0x41edf0
jmp 0x41ee81
lea edi, [esp + 0x2c]
call fcn.00425d80
jmp 0x41ee7d
lea edi, [esp + 0x2c]
call fcn.00425d20
mov ebx, dword [esp + 0x2c]
cmp dword [ebx - 0xc], 0
je 0x41f307
mov ecx, dword [ebp + 0x15c]
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
mov eax, dword [ebp + 0x15c]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, ebp
call fcn.004214b0
mov esi, dword [esp + 0x2c]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
add esi, 0xfffffff0
mov edi, eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x44], edi
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x41eef8
cmp eax, dword [esi]
jne 0x41eef8
mov ebx, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x41ef33
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x420eb7
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.004a751c
add esp, 0x10
add ebx, 0x10
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0xb0]
mov byte [esp + 0x198], 8
mov esi, dword [ebp + 0x14c]
sub esi, dword [esp + 0x24]
add esi, eax
cmp dword [ebp + 0x16c], 0
je 0x41efd1
mov ecx, esi
sub ecx, dword [esp + 0x18]
jns 0x41efd1
test eax, eax
je 0x41efd1
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0xdc]
push eax
push ebp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], esi
call fcn.004256a0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x19c], 9
call fcn.00406e20
mov byte [esp + 0x198], 8
mov eax, dword [esp + 0xd4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41efc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
jmp 0x41f032
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 0
mov ecx, dword [edx - 0x10]
lea eax, [edx - 0x10]
mov dword [esp + 0x40], ecx
je 0x41f032
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x41f00a
cmp dword [edx - 8], 0
jl 0x420ead
mov dword [edx - 0xc], 0
mov edx, dword [esp + 0x2c]
mov word [edx], 0
jmp 0x41f032
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41f020
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
cmp dword [ebp + 0x164], 0
jne 0x41f1f5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x41f285
mov ecx, dword [esp + 0x38]
sub ecx, eax
jne 0x41f0dc
mov ecx, dword [ebx - 0xc]
lea eax, [ecx - 1]
test eax, eax
jl 0x420ead
cmp eax, ecx
jg 0x420ead
movzx eax, word [ebx + eax*2]
cmp ax, 0x20
jne 0x41f0dc
lea ebx, [esp + 0x3c]
call fcn.00425de0
mov ebx, dword [esp + 0x3c]
push ecx
lea eax, [ebx - 0x10]
mov dword [esp + 0x50], esp
mov dword [esp + 0x44], esp
push eax
mov di, 0x20
call fcn.00406ea0
mov edx, dword [esp + 0x48]
add eax, 0x10
add esp, 4
mov dword [edx], eax
call fcn.004259a0
mov edx, dword [ebp + 0x15c]
lea ecx, [esp + 0x10c]
push ecx
mov dword [esp + 0x4c], eax
mov eax, dword [ebx - 0xc]
push eax
push ebx
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov eax, dword [esp + 0x10c]
sub eax, dword [esp + 0x18]
mov edi, dword [esp + 0x44]
add dword [esp + 0x38], eax
cmp dword [ebp + 0xc4], 3
jne 0x41f105
cmp dword [ebp + 0xcc], 0
je 0x41f105
mov ecx, dword [esp + 0x48]
sub esi, dword [esp + 0x38]
mov edx, dword [ebp + 0x15c]
push ecx
push esi
push edx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov eax, dword [esp + 0x18]
sub dword [esp + 0x38], eax
mov eax, dword [ebx - 0xc]
mov edx, dword [ebp + 0x15c]
lea ecx, [esp + 0x18]
push ecx
push eax
push ebx
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
add eax, edi
push eax
add ecx, esi
push ecx
push edi
push esi
mov ecx, ebp
call fcn.00421070
mov eax, dword [ebx - 0xc]
mov edx, dword [ebp + 0x15c]
push eax
push ebx
push edi
push esi
push edx
call dword [sym.imp.GDI32.dll_TextOutW]
push ecx
lea eax, [ebx - 0x10]
mov dword [esp + 0x50], esp
mov dword [esp + 0x44], esp
push eax
mov di, 0x20
call fcn.00406ea0
mov ecx, dword [esp + 0x48]
add eax, 0x10
add esp, 4
mov dword [ecx], eax
call fcn.004259a0
sub dword [esp + 0x48], eax
cmp dword [ebp + 0x54], 0
je 0x41f285
mov edx, dword [ebp + 0x5c]
xor eax, eax
cmp dword [ebp + 0x44], 0x2bc
push edx
setge al
add eax, 1
push eax
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
mov ecx, dword [ebp + 0x15c]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x44]
push 0
push edx
mov edi, eax
mov eax, dword [ebp + 0x15c]
push esi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x18]
mov eax, dword [ebp + 0x15c]
push ecx
add edx, esi
push edx
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov ecx, dword [ebp + 0x15c]
push edi
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x41f285
mov edx, dword [ebp + 0x80]
mov dword [ebp + 0xc4], edx
push ecx
mov ecx, dword [ebx - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea esi, [ebx - 0x10]
mov dword [esp + 0x50], esp
mov dword [esp + 0x44], esp
call edx
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x41f231
cmp eax, dword [esi]
jne 0x41f231
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x41f26c
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x420eb7
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004a751c
add esp, 0x10
mov ecx, dword [esp + 0x44]
add edi, 0x10
mov dword [ecx], edi
mov edi, 0x20
call fcn.004259a0
add dword [ebp + 0xc8], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
add dword [esp + 0x24], edx
cmp dword [eax - 0xc], 0
je 0x41f2d5
mov edx, dword [esp + 0x1a4]
push 1
lea ecx, [esp + 0x28]
push ecx
mov eax, ebp
mov dword [ebp + 0xcc], 1
call fcn.004215d0
mov edx, dword [esp + 0x24]
mov eax, dword [ebp + 0xc8]
mov ecx, dword [ebp + 0xb4]
mov dword [esp + 0x9c], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], ecx
add ebx, 0xfffffff0
mov byte [esp + 0x198], 5
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x41f2f9
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov ecx, dword [esp + 0x2c]
cmp dword [ecx - 0xc], 0
jne 0x41ee8b
mov edx, dword [esp + 0xa4]
xor edi, edi
cmp dword [edx - 0xc], edi
je 0x420c88
lea ebx, [ebp + 0x3c]
mov ecx, ebx
call fcn.004023b0
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0xa8]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x58], esp
mov esi, esp
push eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x24], edi
call fcn.00406ea0
add esp, 4
add eax, 0x10
push ebp
mov dword [esi], eax
call fcn.0041b300
mov esi, eax
cmp esi, edi
mov dword [esp + 0x40], esi
je 0x420c88
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], edi
je 0x41f994
mov edx, dword [esp + 0x3c]
push edx
mov edi, ebp
call fcn.004211a0
test eax, eax
je 0x420c88
xor ecx, ecx
cmp dword [esp + 0x3c], ecx
jne case.0x41f39b.6
lea eax, [esi - 1]
cmp eax, 0x16
ja case.0x41f39b.6
jmp dword [eax*4 + 0x420ec8]
shl dword [ebp + 0x44], 1
mov eax, 0x384
cmp dword [ebp + 0x44], eax
jle case.0x41f39b.6
mov esi, ebp
mov dword [ebp + 0x44], eax
call fcn.004213d0
jmp 0x420c88
xor eax, eax
cmp dword [ebp + 0x48], ecx
mov esi, ebp
sete al
mov dword [ebp + 0x48], eax
call fcn.004213d0
jmp 0x420c88
xor edx, edx
cmp dword [ebp + 0x4c], ecx
mov esi, ebp
sete dl
mov dword [ebp + 0x4c], edx
call fcn.004213d0
jmp 0x420c88
xor eax, eax
cmp dword [ebp + 0x50], ecx
mov esi, ebp
sete al
mov dword [ebp + 0x50], eax
call fcn.004213d0
jmp 0x420c88
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], ecx
jle case.0x41f39b.6
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xe0]
push ecx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
call fcn.00423810
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x19c], 0xa
call fcn.00406e20
lea ecx, [esp + 0xdc]
mov byte [esp + 0x198], 5
call fcn.00401ff0
mov edx, dword [esp + 0x30]
cmp dword [edx - 0xc], 0
je 0x41f5fd
lea eax, [esp + 0x30]
push str.face
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41f4d9
push ecx
lea esi, [ebp + 0x58]
mov ecx, esp
mov dword [esp + 0x50], esp
push esi
call fcn.00406f30
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x1a4], 0xb
call fcn.00406f30
lea edi, [esp + 0xc0]
mov byte [esp + 0x1a0], 5
call fcn.00424f60
push eax
mov ecx, esi
mov byte [esp + 0x19c], 0xc
call fcn.00406e00
mov ecx, edi
mov byte [esp + 0x198], 5
call fcn.00401ff0
jmp 0x41f5fd
lea eax, [esp + 0x30]
push str.size
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41f506
mov ecx, dword [ebp + 0x40]
push 1
push ebp
lea edx, [esp + 0x3c]
call fcn.00422ca0
mov dword [ebp + 0x40], eax
jmp 0x41f5fd
lea ecx, [esp + 0x30]
push str.color
push ecx
call fcn.004261e0
add esp, 8
test al, al
je 0x41f550
cmp dword [ebp + 0x144], 0
je 0x41f53a
mov ecx, dword [ebp + 0x5c]
push ebp
lea esi, [esp + 0x38]
call fcn.00422ad0
mov dword [ebp + 0x5c], eax
jmp 0x41f5fd
push 0
mov eax, 0x4d97fc
mov ecx, ebp
call fcn.0041c080
mov dword [ebp + 0x5c], eax
jmp 0x41f5fd
lea edx, [esp + 0x30]
push str.style
push edx
call fcn.004261e0
add esp, 8
test al, al
je 0x41f576
lea ebx, [esp + 0x34]
mov edi, ebp
call fcn.00425020
jmp 0x41f5fd
lea eax, [esp + 0x30]
push str.weight
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41f59e
mov ecx, dword [ebp + 0x44]
push ecx
lea eax, [esp + 0x38]
call fcn.004228d0
mov dword [ebp + 0x44], eax
jmp 0x41f5fd
lea edx, [esp + 0x30]
push str.bkgnd
push edx
call fcn.004261e0
add esp, 8
test al, al
je 0x41f5fd
lea eax, [esp + 0x34]
push str.transparent
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41f5d4
mov ecx, dword [esp + 0x34]
cmp dword [ecx - 0xc], 0
je 0x41f5dd
cmp dword [ebp + 0x144], 0
jne 0x41f5e6
mov dword [ebp + 0x74], 1
jmp 0x41f5fd
mov ecx, dword [ebp + 0x60]
push ebp
lea esi, [esp + 0x38]
mov dword [ebp + 0x74], 2
call fcn.00422ad0
mov dword [ebp + 0x60], eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx - 0xc]
cmp dword [esp + 0x14], eax
jl 0x41f414
mov esi, ebp
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x80], ecx
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x80], 1
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x80], 2
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x80], 3
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x84], 3
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x84], ecx
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x84], 1
call fcn.004213d0
jmp 0x420c88
mov esi, ebp
mov dword [ebp + 0x84], 2
call fcn.004213d0
jmp 0x420c88
mov ecx, dword [esp + 0xa4]
jmp 0x41f97f
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], ecx
jle case.0x41f39b.6
jmp 0x41f6e0
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xf4]
push edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
call fcn.00423810
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x19c], 0xd
call fcn.00406e20
lea ecx, [esp + 0xf0]
mov byte [esp + 0x198], 5
call fcn.00401ff0
lea eax, [esp + 0x30]
push str.class
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41f7c5
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x4d97fc
call fcn.00401f00
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x1a4], 0xe
call fcn.00406f30
lea edi, [esp + 0x100]
mov byte [esp + 0x1a0], 5
call fcn.00424f60
lea ecx, [esp + 0xc0]
push 0x4dc4a0
push ecx
mov ecx, eax
mov byte [esp + 0x1a0], 0xf
call fcn.004260f0
add esp, 8
mov byte [esp + 0x198], 0x10
mov ecx, dword [eax]
mov eax, ebx
mov edx, ebp
call fcn.00421170
lea ecx, [esp + 0xc0]
call fcn.00401ff0
mov ecx, edi
mov byte [esp + 0x198], 5
call fcn.00401ff0
mov edx, dword [esp + 0x20]
mov eax, dword [edx - 0xc]
cmp dword [esp + 0x14], eax
jl 0x41f6e0
mov esi, ebp
call fcn.004213d0
jmp 0x420c88
lea esi, [ebp + 0xb0]
mov ecx, esi
mov dword [ebp + 0xac], 2
call fcn.004023b0
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], 0
jle 0x41f960
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xcc]
push edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
call fcn.00423810
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x19c], 0x11
call fcn.00406e20
lea ecx, [esp + 0xc8]
mov byte [esp + 0x198], 5
call fcn.00401ff0
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], 0
je 0x41f94f
lea ecx, [esp + 0x30]
push 0x4dc4a4
push ecx
call fcn.004261e0
add esp, 8
test al, al
je 0x41f8d2
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x4d97fc
mov dword [ebp + 0xac], 1
call fcn.00401f00
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x1a4], 0x12
call fcn.00406f30
lea edi, [esp + 0xf0]
mov byte [esp + 0x1a0], 5
call fcn.00424f60
push eax
mov ecx, esi
mov byte [esp + 0x19c], 0x13
call fcn.00406e00
mov ecx, edi
mov byte [esp + 0x198], 5
call fcn.00401ff0
lea eax, [esp + 0x30]
push 0x4dc4b0
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41f94f
push ecx
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x4d97fc
mov dword [ebp + 0xac], 2
call fcn.00401f00
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0x1a4], 0x14
call fcn.00406f30
lea edi, [esp + 0xd8]
mov byte [esp + 0x1a0], 5
call fcn.00424f60
push eax
mov ecx, esi
mov byte [esp + 0x19c], 0x15
call fcn.00406e00
mov ecx, edi
mov byte [esp + 0x198], 5
call fcn.00401ff0
mov eax, dword [esp + 0x20]
mov eax, dword [eax - 0xc]
cmp dword [esp + 0x14], eax
jl 0x41f807
add dword [ebp + 0x17c], 1
mov eax, dword [ebp + 0x17c]
cmp eax, dword [ebp + 0x178]
mov ecx, str.a:hover
je 0x41f97f
mov ecx, str.a:link
mov eax, ebx
mov edx, ebp
call fcn.00421170
mov esi, ebp
call fcn.004213d0
jmp 0x420c88
call fcn.00491248
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
je 0x420ebc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x90], eax
call fcn.00491248
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
je 0x420ebc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x94], eax
lea esi, [esp + 0x114]
call fcn.0041a1d0
mov eax, dword [esp + 0x40]
add eax, 0xfffffffa
cmp eax, 0xe
mov byte [esp + 0x198], 0x17
ja case.0x41fa0d.9
movzx ecx, byte [eax + 0x420f44]
jmp dword [ecx*4 + 0x420f24]
mov eax, ebx
lea esi, [esp + 0x114]
call fcn.00420fa0
mov esi, 1
lea eax, [esp + 0x114]
mov ecx, 0x4db47c
mov edx, ebp
mov dword [esp + 0x164], esi
call fcn.00421170
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], edi
lea ebx, [esi + 0x63]
mov dword [esp + 0x3c], esi
jle 0x41fb88
jmp 0x41fa60
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xf0]
push ecx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
call fcn.00423810
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x19c], 0x18
call fcn.00406e20
mov byte [esp + 0x198], 0x17
mov eax, dword [esp + 0xec]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41fab7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
cmp dword [ecx - 0xc], edi
je 0x41fb71
lea edx, [esp + 0x30]
push str.width
push edx
call fcn.004261e0
add esp, 8
test al, al
je 0x41fafb
lea eax, [esp + 0x34]
call fcn.004251c0
push edi
push ebp
mov ecx, 0x64
lea edx, [esp + 0x3c]
mov dword [esp + 0x44], eax
call fcn.00422ca0
mov ebx, eax
jmp 0x41fb71
lea eax, [esp + 0x30]
push str.size
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x41fb2c
mov ecx, dword [esp + 0x164]
push edi
push ebp
lea edx, [esp + 0x3c]
call fcn.00422ca0
mov dword [esp + 0x164], eax
jmp 0x41fb71
lea ecx, [esp + 0x30]
push str.color
push ecx
call fcn.004261e0
add esp, 8
test al, al
je 0x41fb71
cmp dword [ebp + 0x144], edi
je 0x41fb5d
mov ecx, dword [esp + 0x134]
push ebp
lea esi, [esp + 0x38]
call fcn.00422ad0
jmp 0x41fb6a
push edi
mov eax, 0x4d97fc
mov ecx, ebp
call fcn.0041c080
mov dword [esp + 0x134], eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx - 0xc]
cmp dword [esp + 0x14], eax
jl 0x41fa60
cmp dword [esp + 0x3c], edi
je 0x41fbb6
cmp dword [ebp + 0x164], 1
jne 0x41fb9e
add dword [ebp + 0xc0], ebx
mov ebx, 1
jmp 0x41fbb6
mov eax, dword [esp + 0x1ac]
mov ecx, dword [eax + 8]
sub ecx, dword [eax]
push 0x64
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, eax
mov eax, dword [ebp + 0x164]
cmp eax, 1
jne 0x41fbf2
mov eax, dword [esp + 0x164]
mov ecx, dword [ebp + 0xb8]
add eax, 8
cmp ecx, eax
jle 0x41fbd7
mov eax, ecx
mov edx, dword [ebp + 0x80]
add dword [esp + 0x24], ebx
mov dword [ebp + 0xb8], eax
mov dword [ebp + 0xc4], edx
jmp case.0x41fa0d.9
cmp eax, edi
jne 0x41fc2f
mov eax, dword [ebp + 0xb8]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x134]
mov esi, dword [ebp + 0x15c]
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
push 1
sar eax, 1
add eax, ecx
push edi
push eax
lea ecx, [ebx + edx]
push ecx
push eax
mov eax, dword [esp + 0x178]
mov ecx, edx
call fcn.00419db0
add dword [esp + 0x24], ebx
jmp case.0x41fa0d.9
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], edi
mov eax, 1
je 0x41fc8e
push eax
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x28]
call fcn.00425f90
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x19c], 0x19
call fcn.00406e20
lea ecx, [esp + 0xd8]
mov byte [esp + 0x198], 0x17
call fcn.00401ff0
push edi
push ebp
mov ecx, 1
lea edx, [esp + 0x28]
call fcn.00422ca0
mov edx, dword [esp + 0x1a4]
push eax
lea ecx, [esp + 0x28]
push ecx
mov eax, ebp
mov dword [ebp + 0xcc], edi
call fcn.004215d0
mov edx, dword [esp + 0x24]
mov eax, dword [ebp + 0xc8]
mov ecx, dword [ebp + 0xb4]
mov dword [esp + 0x9c], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], ecx
jmp case.0x41fa0d.9
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], edi
mov eax, 1
je 0x41fd22
push eax
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x28]
call fcn.00425f90
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x19c], 0x1a
call fcn.00406e20
lea ecx, [esp + 0xf4]
mov byte [esp + 0x198], 0x17
call fcn.00401ff0
push edi
push ebp
mov ecx, 1
lea edx, [esp + 0x28]
call fcn.00422ca0
push ebp
lea edi, [esp + 0x28]
call fcn.004217e0
jmp case.0x41fa0d.9
mov eax, 0x64
mov esi, 1
lea ecx, [esp + 0x90]
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x84], esi
mov dword [esp + 0x70], eax
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], 0xff00ff
mov dword [esp + 0x80], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
call fcn.004023b0
lea ecx, [esp + 0x94]
call fcn.004023b0
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, ebp
call fcn.00424a70
mov ecx, dword [esp + 0x58]
cmp ecx, edi
mov eax, dword [esp + 0x90]
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
jne 0x41fdc8
cmp edx, edi
jne 0x41fdc8
cmp ebx, edi
jne 0x41fdc8
cmp dword [eax - 0xc], edi
je case.0x41fa0d.9
cmp ecx, edi
mov dword [esp + 0x3c], esi
je 0x41fddc
push ecx
call fcn.0041a5d0
mov dword [esp + 0x14], eax
jmp 0x41fe14
cmp dword [eax - 0xc], edi
je 0x41fdec
call fcn.0041a5f0
mov dword [esp + 0x14], eax
jmp 0x41fe14
cmp edx, edi
je 0x41fe04
mov eax, dword [esp + 0x94]
push edx
push ebp
call fcn.0041a610
mov dword [esp + 0x14], eax
jmp 0x41fe14
cmp ebx, edi
je case.0x41fa0d.9
mov dword [esp + 0x14], ebx
mov dword [esp + 0x3c], edi
cmp dword [esp + 0x14], edi
je case.0x41fa0d.9
mov eax, dword [esp + 0x7c]
or eax, dword [esp + 0x78]
mov dword [esp + 0x44], edi
test eax, 0x300
je 0x41fe35
mov dword [esp + 0x44], esi
mov ecx, dword [esp + 0x14]
lea esi, [esp + 0x18]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.004171d0
cmp dword [esp + 0x84], edi
je 0x41fe69
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x18]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x88], edi
je 0x41fe88
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x1c]
push 0x64
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [esp + 0x70], eax
cmp dword [esp + 0x6c], edi
je 0x41feb8
cmp dword [esp + 0x70], edi
je 0x41feb8
cmp dword [esp + 0x44], edi
je 0x41feb8
mov ebx, dword [ebp + 0x190]
add ebx, dword [esp + 0x6c]
mov eax, dword [ebp + 0x194]
add eax, dword [esp + 0x70]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
jmp 0x41febc
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0x14c]
sub eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xb0]
add eax, ecx
cmp dword [ebp + 0x16c], edi
je 0x41ff21
sub eax, ebx
jns 0x41ff21
cmp ecx, edi
je 0x41ff21
mov edx, dword [esp + 0x1a4]
push 1
lea ecx, [esp + 0x28]
push ecx
mov eax, ebp
mov dword [ebp + 0xcc], 1
call fcn.004215d0
mov edx, dword [esp + 0x24]
mov eax, dword [ebp + 0xc8]
mov ecx, dword [ebp + 0xb4]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x9c], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], ecx
sub dword [esp + 0x38], ebx
cmp dword [ebp + 0x164], 1
jne 0x41ff3a
mov edx, dword [ebp + 0x80]
mov dword [ebp + 0xc4], edx
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x28]
mov eax, ebp
call fcn.00421560
cmp dword [esp + 0x6c], edi
mov esi, eax
je 0x420028
cmp dword [esp + 0x70], edi
je 0x420028
cmp dword [ebp + 0x164], edi
jne 0x420028
mov eax, dword [esp + 0x1c]
add eax, esi
push eax
mov eax, dword [esp + 0x28]
add ebx, eax
push ebx
push esi
push eax
mov ecx, ebp
call fcn.00421070
cmp dword [ebp + 0xac], edi
je 0x41ffa0
mov ecx, dword [ebp + 0x17c]
cmp ecx, dword [ebp + 0x178]
jne 0x41ffa0
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x78], edx
cmp dword [ebp + 0x144], edi
jne 0x41ffb8
mov eax, dword [esp + 0x78]
and eax, 0xff00
or eax, 8
mov dword [esp + 0x78], eax
mov ecx, dword [esp + 0x50]
mov edx, dword [ebp + 0x19c]
mov eax, dword [ebp + 0x198]
push ecx
mov ecx, dword [ebp + 0x194]
push edx
mov edx, dword [ebp + 0x190]
push eax
mov eax, dword [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
push edx
mov edx, dword [esp + 0xa0]
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [ebp + 0x15c]
push ecx
push esi
push edx
push eax
mov eax, dword [esp + 0xa0]
lea ecx, [ebp + 0xd0]
push ecx
call fcn.00418db0
mov ebx, dword [esp + 0x18]
xor edi, edi
add dword [esp + 0x24], ebx
cmp dword [esp + 0x3c], edi
je case.0x41fa0d.9
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x41fa0d.9
mov eax, 1
mov ebx, 0x64
lea ecx, [esp + 0x90]
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x88], eax
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
call fcn.004023b0
lea ecx, [esp + 0x94]
call fcn.004023b0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
call fcn.00424a70
cmp dword [esp + 0x58], edi
jne 0x4200c5
cmp dword [esp + 0x5c], edi
jne 0x4200c5
cmp dword [esp + 0x60], edi
jne 0x4200c5
mov edx, dword [esp + 0x90]
cmp dword [edx - 0xc], edi
je case.0x41fa0d.9
cmp dword [esp + 0x84], edi
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x6c]
mov eax, esi
mov dword [esp + 0x3c], 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
je 0x420103
push ebx
push ecx
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x88], edi
je 0x420125
push ebx
push esi
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x58], edi
je 0x42014b
mov esi, eax
mov ebx, ecx
call fcn.0049402d
movzx ecx, word [esp + 0x58]
mov eax, dword [eax + 0xc]
push edi
push esi
push ebx
push 1
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
jmp 0x420195
mov edx, dword [esp + 0x90]
cmp dword [edx - 0xc], edi
je 0x420169
push 0x10
push eax
push ecx
push 1
mov eax, edx
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
jmp 0x420195
cmp dword [esp + 0x5c], edi
je 0x420185
push eax
mov eax, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0x64]
push ecx
push ebp
call fcn.0041a550
jmp 0x420195
mov eax, dword [esp + 0x60]
cmp eax, edi
je case.0x41fa0d.9
mov dword [esp + 0x3c], edi
mov ecx, eax
cmp ecx, edi
mov dword [esp + 0x14], eax
je case.0x41fa0d.9
mov eax, dword [esp + 0x7c]
or eax, dword [esp + 0x78]
test eax, 0x300
jne 0x4201b6
xor esi, esi
jmp 0x4201bb
mov esi, 1
lea eax, [esp + 0x18]
mov dword [esp + 0x44], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.00417170
mov ebx, dword [esp + 0x18]
cmp ebx, edi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], eax
je 0x420200
cmp eax, edi
je 0x420200
cmp esi, edi
je 0x420200
add ebx, dword [ebp + 0x190]
add eax, dword [ebp + 0x194]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14c]
sub eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xb0]
add eax, ecx
cmp dword [ebp + 0x16c], edi
je 0x420265
sub eax, ebx
jns 0x420265
cmp ecx, edi
je 0x420265
push 1
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x1ac]
mov eax, ebp
mov dword [ebp + 0xcc], 1
call fcn.004215d0
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp + 0xc8]
mov edx, dword [ebp + 0xb4]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], edx
sub dword [esp + 0x38], ebx
cmp dword [ebp + 0x164], 1
jne 0x42027e
mov eax, dword [ebp + 0x80]
mov dword [ebp + 0xc4], eax
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x28]
mov eax, ebp
call fcn.00421560
cmp dword [esp + 0x6c], edi
mov esi, eax
je 0x420359
cmp dword [esp + 0x70], edi
je 0x420359
cmp dword [ebp + 0x164], edi
jne 0x420359
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
add ecx, esi
push ecx
add ebx, eax
push ebx
push esi
push eax
mov ecx, ebp
call fcn.00421070
cmp dword [ebp + 0xac], edi
je 0x4202e4
mov edx, dword [ebp + 0x17c]
cmp edx, dword [ebp + 0x178]
jne 0x4202e4
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x78], eax
cmp dword [ebp + 0x144], edi
jne 0x4202fd
mov ecx, dword [esp + 0x78]
and ecx, 0xff00
or ecx, 8
mov dword [esp + 0x78], ecx
mov edx, dword [esp + 0x50]
mov eax, dword [ebp + 0x19c]
mov ecx, dword [ebp + 0x198]
push edx
mov edx, dword [ebp + 0x194]
mov edi, dword [esp + 0x74]
push eax
mov eax, dword [ebp + 0x190]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [ebp + 0x15c]
push edx
push esi
push eax
mov eax, dword [esp + 0x9c]
push ecx
mov ecx, dword [esp + 0x94]
lea edx, [ebp + 0xd0]
push edx
call fcn.00419080
mov ebx, dword [esp + 0x18]
xor edi, edi
add dword [esp + 0x24], ebx
cmp dword [esp + 0x3c], edi
je case.0x41fa0d.9
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp case.0x41fa0d.9
mov eax, 0x64
mov esi, 1
lea ecx, [esp + 0x90]
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x84], esi
mov dword [esp + 0x70], eax
mov dword [esp + 0x88], esi
mov dword [esp + 0x74], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x8c], 0xff00ff
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], edi
call fcn.004023b0
lea ecx, [esp + 0x94]
call fcn.004023b0
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x24]
push edx
mov ecx, ebp
call fcn.00424a70
mov eax, dword [esp + 0x7c]
or eax, dword [esp + 0x78]
mov dword [esp + 0x44], edi
test eax, 0x300
je 0x42040d
mov dword [esp + 0x44], esi
mov ecx, dword [esp + 0x58]
cmp ecx, edi
mov eax, dword [esp + 0x90]
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
jne 0x42067e
cmp edx, edi
jne 0x42067e
cmp ebx, edi
jne 0x42067e
cmp dword [eax - 0xc], edi
jne 0x42067e
cmp dword [ebp + 0x11c], edi
je case.0x41fa0d.9
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 0x11c]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
mov ecx, dword [esp + 0x54]
cmp ecx, eax
jge case.0x41fa0d.9
push edi
push ecx
mov ecx, dword [ebp + 0x11c]
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
cmp eax, edi
mov dword [esp + 0x14], eax
je case.0x41fa0d.9
cmp dword [esp + 0x84], edi
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
je 0x4204b6
mov edx, dword [ebp + 0x120]
push 0x64
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, eax
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x88], edi
je 0x4204d7
mov eax, dword [ebp + 0x124]
push 0x64
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
test ebx, ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xa8], ebx
mov edi, ecx
je 0x42050a
test ecx, ecx
je 0x42050a
cmp dword [esp + 0x44], 0
je 0x42050a
mov eax, dword [ebp + 0x190]
mov edi, dword [ebp + 0x194]
add eax, ebx
mov dword [esp + 0xa8], eax
add edi, ecx
mov eax, dword [ebp + 0x14c]
sub eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xb0]
add eax, ecx
cmp dword [ebp + 0x16c], 0
je 0x420575
sub eax, dword [esp + 0xa8]
jns 0x420575
test ecx, ecx
je 0x420575
mov edx, dword [esp + 0x1a4]
push 1
lea ecx, [esp + 0x28]
push ecx
mov eax, ebp
mov dword [ebp + 0xcc], 1
call fcn.004215d0
mov edx, dword [esp + 0x24]
mov eax, dword [ebp + 0xc8]
mov ecx, dword [ebp + 0xb4]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x9c], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], ecx
sub dword [esp + 0x38], ebx
cmp dword [ebp + 0x164], 1
jne 0x42058e
mov edx, dword [ebp + 0x80]
mov dword [ebp + 0xc4], edx
mov ecx, dword [esp + 0x28]
mov esi, edi
mov eax, ebp
call fcn.00421560
test ebx, ebx
mov esi, eax
je 0x42066e
cmp dword [esp + 0x1c], 0
je 0x42066e
cmp dword [ebp + 0x164], 0
jne 0x42066e
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xa8]
add edi, esi
push edi
add ecx, eax
push ecx
push esi
push eax
mov ecx, ebp
call fcn.00421070
cmp dword [ebp + 0xac], 0
je 0x4205f6
mov edx, dword [ebp + 0x17c]
cmp edx, dword [ebp + 0x178]
jne 0x4205f6
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x78], eax
cmp dword [ebp + 0x144], 0
jne 0x420610
mov ecx, dword [esp + 0x78]
and ecx, 0xff00
or ecx, 8
mov dword [esp + 0x78], ecx
mov edx, dword [esp + 0x50]
mov eax, dword [ebp + 0x19c]
mov ecx, dword [ebp + 0x198]
push edx
mov edx, dword [ebp + 0x194]
mov edi, dword [esp + 0x20]
push eax
mov eax, dword [ebp + 0x190]
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [ebp + 0x15c]
push edx
push esi
push eax
mov eax, dword [esp + 0x9c]
push ecx
mov ecx, dword [esp + 0x40]
lea edx, [ebp + 0xd0]
push edx
call fcn.00419080
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov ecx, dword [esp + 0xa8]
add dword [esp + 0x24], ecx
jmp case.0x41fa0d.9
cmp ecx, edi
mov dword [esp + 0x3c], esi
je 0x42068e
push ecx
call fcn.0041a5d0
jmp 0x4206bc
cmp dword [eax - 0xc], edi
je 0x42069a
call fcn.0041a5f0
jmp 0x4206bc
cmp edx, edi
je 0x4206ae
mov eax, dword [esp + 0x94]
push edx
push ebp
call fcn.0041a610
jmp 0x4206bc
cmp ebx, edi
je case.0x41fa0d.9
mov eax, ebx
mov dword [esp + 0x3c], edi
cmp eax, edi
mov dword [esp + 0x14], eax
je case.0x41fa0d.9
lea esi, [esp + 0x18]
mov ecx, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.004171d0
mov eax, dword [esp + 0x64]
cmp eax, edi
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x68]
jne 0x42070b
cmp esi, edi
jne 0x420703
cmp edx, ecx
mov esi, edx
jl 0x4206fb
mov esi, ecx
mov eax, esi
mov dword [esp + 0x64], eax
jmp 0x420711
mov eax, esi
mov dword [esp + 0x64], eax
jmp 0x420715
cmp esi, edi
jne 0x420715
mov esi, eax
mov dword [esp + 0x68], esi
cmp dword [esp + 0x84], edi
je 0x420734
mov edx, dword [esp + 0x6c]
push 0x64
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ebx, eax
mov dword [esp + 0x6c], ebx
jmp 0x420738
mov ebx, dword [esp + 0x6c]
cmp dword [esp + 0x88], edi
mov eax, dword [esp + 0x70]
je 0x420753
push 0x64
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [esp + 0x70], eax
cmp ebx, edi
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], eax
je 0x42078d
cmp eax, edi
je 0x42078d
cmp dword [esp + 0x44], edi
je 0x42078d
mov ecx, dword [ebp + 0x190]
add ecx, ebx
mov dword [esp + 0xa8], ecx
mov ecx, dword [ebp + 0x194]
add ecx, eax
mov dword [esp + 0xac], ecx
mov eax, dword [esp + 0x18]
cdq
idiv dword [esp + 0x64]
mov edi, eax
mov eax, dword [esp + 0x1c]
cdq
idiv dword [esp + 0x68]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x74]
test eax, eax
je 0x420843
mov ecx, dword [ebp + 0x164]
cmp ecx, 1
jne 0x4207ff
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x54]
imul edx, edi
lea esi, [ebp + 0x280]
lea ebx, [esp + 0xfc]
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x100], edx
mov dword [esp + 0x108], eax
mov dword [esp + 0x104], 0
call fcn.00426b70
jmp 0x420843
test ecx, ecx
jne 0x420843
add dword [ebp + 0x180], 1
mov edi, dword [ebp + 0x180]
lea esi, [ebp + 0x280]
call fcn.00426b40
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x100], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x104], edx
mov dword [esp + 0x108], eax
mov dword [esp + 0x54], ecx
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
mov ecx, eax
imul ecx, edi
cmp dword [esp + 0x54], ecx
jge 0x4209f9
test edi, edi
je 0x4209f9
test eax, eax
je 0x4209f9
mov eax, dword [ebp + 0x14c]
mov ecx, dword [esp + 0xb0]
sub eax, ebx
add eax, ecx
cmp dword [ebp + 0x16c], 0
je 0x4208cf
sub eax, dword [esp + 0xa8]
jns 0x4208cf
test ecx, ecx
je 0x4208cf
push 1
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x1ac]
mov eax, ebp
mov dword [ebp + 0xcc], 1
call fcn.004215d0
mov ebx, dword [esp + 0x24]
mov eax, dword [ebp + 0xc8]
mov ecx, dword [ebp + 0xb4]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0xa8]
sub dword [esp + 0x38], edx
cmp dword [ebp + 0x164], 1
jne 0x4208ef
mov eax, dword [ebp + 0x80]
mov dword [ebp + 0xc4], eax
mov edi, dword [esp + 0xac]
mov ecx, dword [esp + 0x28]
mov esi, edi
mov eax, ebp
call fcn.00421560
cmp dword [esp + 0x6c], 0
mov esi, eax
je 0x4209ee
cmp dword [esp + 0x70], 0
je 0x4209ee
cmp dword [ebp + 0x164], 0
jne 0x4209ee
mov ecx, dword [esp + 0xa8]
add edi, esi
push edi
add ecx, ebx
push ecx
push esi
push ebx
mov ecx, ebp
call fcn.00421070
cmp dword [ebp + 0xac], 0
je 0x42095f
mov edx, dword [ebp + 0x17c]
cmp edx, dword [ebp + 0x178]
jne 0x42095f
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x78], eax
jmp 0x420963
mov eax, dword [esp + 0x78]
cmp dword [ebp + 0x144], 0
jne 0x420978
and eax, 0xff00
or eax, 8
mov dword [esp + 0x78], eax
mov ecx, dword [esp + 0x50]
mov edx, dword [ebp + 0x19c]
push ecx
mov ecx, dword [ebp + 0x198]
push edx
mov edx, dword [ebp + 0x194]
push ecx
mov ecx, dword [ebp + 0x190]
push edx
mov edx, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x94]
push edx
mov edx, dword [esp + 0x80]
push eax
mov eax, dword [esp + 0xa8]
push eax
mov eax, dword [esp + 0x84]
push ecx
mov ecx, dword [esp + 0x78]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x9c]
push ecx
mov ecx, dword [esp + 0x9c]
push edx
mov edx, dword [ebp + 0x15c]
push eax
push ecx
push esi
push ebx
push edx
lea eax, [ebp + 0xd0]
push eax
call fcn.00419640
add ebx, dword [esp + 0xa8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x3c], 0
je case.0x41fa0d.9
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp case.0x41fa0d.9
lea ecx, [esp + 0x2c]
xor esi, esi
call fcn.004023b0
mov edx, dword [esp + 0x20]
cmp dword [edx - 0xc], edi
jle case.0x41fa0d.9
lea esp, [esp]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xc0]
push ecx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
call fcn.00423810
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x19c], 0x1b
call fcn.00406e20
mov byte [esp + 0x198], 0x17
mov eax, dword [esp + 0xbc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420a87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
cmp dword [ecx - 0xc], edi
je 0x420b5c
lea edx, [esp + 0x30]
push str.idres
push edx
call fcn.004261e0
add esp, 8
test al, al
je 0x420abe
push edi
push ebp
mov ecx, esi
lea edx, [esp + 0x3c]
call fcn.00422ca0
mov esi, eax
jmp 0x420b5c
lea eax, [esp + 0x30]
push str.iddll
push eax
call fcn.004261e0
add esp, 8
test al, al
je 0x420ae5
push edi
push ebp
xor ecx, ecx
lea edx, [esp + 0x3c]
call fcn.00422ca0
mov esi, eax
jmp 0x420b5c
lea ecx, [esp + 0x30]
push str.srcdll
push ecx
call fcn.004261e0
add esp, 8
test al, al
je 0x420b5c
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x50], esp
push edx
call fcn.00406f30
push ecx
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
mov byte [esp + 0x1a4], 0x1c
call fcn.00406f30
lea edi, [esp + 0xcc]
mov byte [esp + 0x1a0], 0x17
call fcn.00424f60
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x19c], 0x1d
call fcn.00406e20
mov ecx, edi
mov byte [esp + 0x198], 0x17
call fcn.00401ff0
xor edi, edi
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx - 0xc]
cmp dword [esp + 0x14], eax
jl 0x420a30
cmp esi, edi
je case.0x41fa0d.9
mov ecx, esi
lea ebx, [esp + 0xcc]
call fcn.0041a680
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x19c], 0x1e
call fcn.00406e20
mov ecx, ebx
mov byte [esp + 0x198], 0x17
call fcn.00401ff0
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 0xc]
test eax, eax
je case.0x41fa0d.9
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [ebp + 0x15c]
push ecx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
cmp dword [ebp + 0x164], 1
jne 0x420bd8
mov ecx, dword [ebp + 0x80]
mov dword [ebp + 0xc4], ecx
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
push edi
mov ecx, ebp
call fcn.004214b0
cmp dword [ebp + 0x164], 0
mov esi, eax
jne 0x420c22
mov edx, dword [esp + 0x18]
add edi, esi
push edi
mov edi, dword [esp + 0x28]
add edx, edi
push edx
push esi
push edi
call fcn.00421070
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov eax, dword [ebp + 0x15c]
push esi
push edi
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
jmp 0x420c26
mov edi, dword [esp + 0x24]
add edi, dword [esp + 0x18]
mov dword [esp + 0x24], edi
lea esi, [esp + 0x114]
call fcn.0041a260
mov byte [esp + 0x198], 5
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420c65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420c88
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x1a8]
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
cmp dword [esp + 0xa0], eax
jl 0x41ecf8
mov edx, dword [esp + 0x24]
cmp dword [esp + 0x9c], edx
je 0x420ccd
mov edx, dword [esp + 0x1a4]
push 1
lea eax, [esp + 0x28]
push eax
mov eax, ebp
mov dword [ebp + 0xcc], 0
call fcn.004215d0
mov ecx, dword [ebp + 0x15c]
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1ac]
sub eax, dword [edx + 4]
mov ecx, dword [esp + 0x1a4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xb4]
cmp eax, dword [ebp + 0x170]
mov dword [esp + 0xa0], eax
jge 0x420dbc
mov ecx, eax
lea eax, [ecx*8]
sub eax, ecx
add eax, eax
add eax, eax
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x254]
test eax, eax
je 0x420d51
mov ecx, dword [ebp + 0x258]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0xa0], eax
jb 0x420d56
call fcn.004a79fe
mov esi, dword [ebp + 0x254]
add esi, dword [esp + 0x50]
lea ebx, [ebp + 0xb4]
mov ecx, 7
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0xc0]
test eax, eax
je 0x420d9a
mov esi, dword [esp + 0x1a4]
mov edx, dword [esi]
push 0x64
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
add dword [ebx], eax
mov ebx, dword [ebx]
mov eax, dword [esi]
cmp eax, ebx
jg 0x420d98
mov eax, ebx
mov dword [esi], eax
mov eax, dword [esp + 0xa0]
add dword [esp + 0x50], 0x1c
add eax, 1
cmp eax, dword [ebp + 0x170]
mov dword [esp + 0xa0], eax
jl 0x420d23
mov byte [esp + 0x198], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420de4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x198], 3
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x198], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x198], 1
mov eax, dword [esp + 0xa4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x198], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420e8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x190]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x188
ret 0x10
push 0x80070057
call fcn.00401ee0
call fcn.00401e70
push 0x80004005
call fcn.00401ee0
mov edi, edi
mov byte [0xc20041f3], al
inc ecx
add cl, bl
inc ecx
add al, dh
inc ecx
add byte [edi], al
hlt