Function at 0x4d16e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x52dab5
mov eax, dword fs:[0]
push eax
sub esp, 0x640
mov eax, dword [0x55c4c8]
xor eax, esp
mov dword [esp + 0x638], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55c4c8]
xor eax, esp
push eax
lea eax, [esp + 0x654]
mov dword fs:[0], eax
mov edx, dword [esp + 0x678]
mov eax, dword [esp + 0x670]
mov esi, dword [esp + 0x664]
mov ebp, dword [esp + 0x668]
mov ecx, dword [esp + 0x66c]
mov dword [esp + 0xa4], edx
mov edx, dword [esp + 0x67c]
mov dword [esp + 0xb0], edx
mov edx, dword [esp + 0x680]
mov dword [esp + 0x20], esi
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x78], edx
test eax, eax
je 0x4d39cf
test ebp, ebp
je 0x4d39cf
push ecx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x4d39cf
mov ebx, dword [esp + 0x684]
shr ebx, 0xa
not bl
and bl, 1
xor edi, edi
push 0x28
mov byte [esp + 0x21], bl
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], 0xa
call fcn.0050a996
add esp, 4
mov dword [esp + 0x6c], eax
mov dword [esp + 0x65c], edi
push 0x28
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], 0xa
call fcn.0050a996
add esp, 4
mov dword [esp + 0x84], eax
push 0x28
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 0xa
call fcn.0050a996
add esp, 4
mov dword [esp + 0x50], eax
xor eax, eax
mov byte [esp + 0x65c], 2
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
lea eax, [esp + 0x154]
push eax
push esi
mov dword [esp + 0x15c], edi
call dword [sym.imp.GDI32.dll_GetClipBox]
mov edi, dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
lea ecx, [esp + 0x154]
push ecx
call edi
mov edx, dword [esp + 0x34]
push edx
mov dword [esp + 0xe4], eax
call edi
mov dword [esp + 0x130], eax
test bl, bl
je 0x4d1868
push 1
push eax
push esi
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov eax, ebp
call fcn.004b0b80
add eax, 0x90
mov dword [esp + 0x30], eax
mov eax, ebp
call fcn.004b0b80
mov eax, dword [eax]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
mov dword [esp + 0x130], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x674]
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl ecx, 8
shr eax, 0x10
or edx, ecx
movzx eax, al
shl edx, 8
or edx, eax
push edx
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, ebp
call fcn.004b0b50
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl ecx, 8
shr eax, 0x10
or edx, ecx
movzx eax, al
shl edx, 8
or edx, eax
push edx
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 0x684]
mov edi, eax
and edi, 1
mov dword [esp + 0x120], edi
jne 0x4d190a
test al, 0xe
je 0x4d1a4c
test eax, 0x400
jne 0x4d1a4c
mov ecx, dword [esp + 0x684]
mov eax, dword [esp + 0x674]
or ecx, 0x400
push ecx
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
lea edx, [esp + 0x68]
push edx
push ebx
push ebx
push eax
push ecx
lea edx, [esp + 0xcc]
push edx
push ebp
push esi
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], 0x270f
mov dword [esp + 0xe4], 0x64
mov dword [esp + 0x88], ebx
call fcn.004d16e0
add esp, 0x24
test byte [esp + 0x684], 0x20
je 0x4d19de
mov esi, dword [esp + 0xbc]
cmp edi, ebx
mov edi, dword [esp + 0x34]
je 0x4d19c4
mov ecx, dword [edi]
mov eax, dword [edi + 8]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x64], eax
mov eax, esi
sub eax, dword [esp + 0xb4]
cdq
sub eax, edx
mov edx, dword [esp + 0x64]
sar eax, 1
sub edx, eax
lea eax, [edx + ecx]
mov dword [edi], eax
sub eax, dword [esp + 0xb4]
add eax, esi
mov dword [edi + 8], eax
test byte [esp + 0x684], 2
je 0x4d19e2
mov eax, dword [edi + 8]
sub eax, esi
add eax, dword [esp + 0xb4]
mov dword [edi], eax
jmp 0x4d19e2
mov edi, dword [esp + 0x34]
test byte [esp + 0x684], 4
mov ecx, dword [esp + 0xc0]
je 0x4d1a31
mov esi, dword [edi + 4]
mov eax, dword [edi + 0xc]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x64], eax
mov eax, ecx
sub eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x64]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
lea eax, [ecx + esi]
mov ecx, dword [esp + 0xc0]
mov dword [edi + 4], eax
sub eax, dword [esp + 0xb8]
add eax, ecx
mov dword [edi + 0xc], eax
test byte [esp + 0x684], 8
je 0x4d1a52
mov edx, dword [edi + 0xc]
sub edx, ecx
add edx, dword [esp + 0xb8]
mov dword [edi + 4], edx
jmp 0x4d1a52
mov edi, dword [esp + 0x34]
xor ebx, ebx
lea eax, [esp + 0x4b8]
xor ecx, ecx
mov byte [esp + 0x4b], 0
mov dword [esp + 0x4b4], eax
mov word [esp + 0x4b8], cx
mov ecx, dword [esp + 0xa4]
mov byte [esp + 0x65c], 3
mov edx, dword [ebp + 0x51c]
mov eax, dword [ebp + 0x520]
mov ebp, dword [esp + 0xb0]
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x78]
mov eax, dword [esp + 0x68]
cmp eax, dword [edx]
jge 0x4d1aff
mov ecx, dword [esp + 0xac]
mov edx, dword [esp + 0xa8]
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4d1ae9
mov eax, dword [ebp]
push 0xffffffffffffffff
push eax
lea esi, [esp + 0x4bc]
call fcn.004b50c0
mov byte [esp + 0x4b], 1
inc dword [esp + 0x68]
add dword [esp + 0x38], 0x10
add ebp, 0x84
cmp byte [esp + 0x4b], 0
je 0x4d1aa7
mov ecx, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x10]
add eax, dword [ecx]
mov dword [esp + 0x44], edx
xor dl, dl
xor ebp, ebp
mov dword [esp + 0x80], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], dl
mov byte [esp + 0x2f], dl
mov byte [esp + 0x27], dl
mov dword [esp + 0x68], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov byte [esp + 0x65c], 6
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov dword [esp + 0xe4], eax
mov byte [esp + 0x5f], dl
mov byte [esp + 0x5e], dl
mov byte [esp + 0x4a], dl
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x1c], dl
cmp cx, bx
je 0x4d38bc
jmp 0x4d1bdb
mov ebp, dword [esp + 0x80]
mov dl, byte [esp + 0x1e]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x40]
mov esi, dword [esi + 8]
cmp edi, esi
mov ebx, dword [esp + 0x44]
jge 0x4d3580
cmp cx, 0xa
je 0x4d3586
test dl, dl
jne 0x4d3580
cmp byte [esp + 0x1f], dl
jne 0x4d328a
cmp cx, 0x3c
je 0x4d1c1e
cmp cx, 0x7b
jne 0x4d2d82
movzx edx, word [eax + 2]
lea esi, [eax + 2]
cmp dx, 0x61
jb 0x4d2d82
cmp dx, 0x7a
ja 0x4d2d82
movzx edx, word [eax + 4]
cmp dx, 0x20
je 0x4d1c53
cmp dx, 0x3e
je 0x4d1c53
cmp dx, 0x7d
jne 0x4d2d82
mov eax, esi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
add ecx, 0xffffff9f
cmp ecx, 0x18
ja case.0x4d1c6f.100
movzx ecx, byte [ecx + 0x4d3adc]
jmp dword [ecx*4 + 0x4d3aa8]
add eax, 2
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jbe 0x4d1ca5
mov esi, dword [sym.imp.USER32.dll_CharNextW]
jmp 0x4d1c90
cmp cx, 0x20
ja 0x4d1ca5
push eax
call esi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d1c90
mov edx, dword [esp + 0x78]
cmp ebp, dword [edx]
jge 0x4d1d1f
cmp byte [esp + 0x1c], 0
jne 0x4d1d1f
mov esi, ebp
imul esi, esi, 0x84
add esi, dword [esp + 0xb0]
mov edi, esi
call fcn.004b5170
mov ecx, dword [esp + 0x18]
movzx eax, word [ecx]
test ax, ax
je 0x4d1d1f
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
lea esp, [esp]
cmp ax, 0x3e
je 0x4d1d1f
cmp ax, 0x7d
je 0x4d1d1f
push ecx
call ebx
mov ecx, dword [esp + 0x18]
mov edi, eax
cmp ecx, edi
jae 0x4d1d17
lea esp, [esp]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 0x18], ecx
call fcn.004b51d0
mov ecx, dword [esp + 0x18]
cmp ecx, edi
jb 0x4d1d00
movzx eax, word [ecx]
test ax, ax
jne 0x4d1ce0
mov edi, dword [esp + 0x4c]
mov ecx, edi
call fcn.004b0af0
cmp byte [esp + 0x4b], 0
mov ebx, eax
je 0x4d1d64
mov eax, dword [esp + 0x78]
cmp ebp, dword [eax]
jge 0x4d1d64
mov ecx, dword [esp + 0xb0]
imul ebp, ebp, 0x84
mov ecx, dword [ecx + ebp]
lea eax, [esp + 0x4b4]
call fcn.004b51f0
test al, al
je 0x4d1d64
mov ecx, edi
call fcn.004b0b20
mov ebx, eax
push ebx
lea esi, [esp + 0x88]
call fcn.004b4da0
mov edx, ebx
shr edx, 8
movzx ecx, bl
movzx eax, dl
shl ecx, 8
or eax, ecx
shr ebx, 0x10
movzx edx, bl
shl eax, 8
or eax, edx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, edi
call fcn.004b0b80
mov ecx, dword [esp + 0x70]
test ecx, ecx
jle 0x4d1dbd
lea eax, [ecx - 1]
test eax, eax
jl 0x4d1dbb
cmp eax, ecx
jge 0x4d1dbb
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + eax*4]
jmp 0x4d1dbd
xor eax, eax
cmp byte [eax + 0x8d], 0
jne 0x4d1e79
movzx ebx, byte [eax + 0x8e]
movzx ecx, byte [eax + 0x8c]
mov esi, dword [eax + 0x88]
mov ebp, dword [eax + 4]
push ebx
push 1
push ecx
push esi
push ebp
push edi
mov byte [esp + 0x130], cl
call fcn.004b0f70
test eax, eax
jne 0x4d1e0b
mov edx, dword [esp + 0x118]
push ebx
push 1
push edx
push esi
push ebp
push edi
call fcn.004b0d50
push eax
mov eax, edi
call fcn.004b1120
mov edi, eax
push edi
lea esi, [esp + 0x70]
call fcn.004b4da0
mov eax, dword [edi]
mov ecx, dword [esp + 0x20]
push eax
lea esi, [edi + 0x90]
push ecx
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [esp + 0x54]
lea eax, [edi - 1]
test eax, eax
jl 0x4d1e4f
cmp eax, edi
jge 0x4d1e4f
mov edx, dword [esp + 0x50]
mov ecx, dword [edx + eax*4]
jmp 0x4d1e51
xor ecx, ecx
mov edx, dword [esi + 0x10]
mov esi, dword [esi]
add edx, esi
add ecx, edx
cmp dword [esp + 0x28], ecx
jg 0x4d1e79
test eax, eax
jl 0x4d1e71
cmp eax, edi
jge 0x4d1e71
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx + eax*4]
jmp 0x4d1e73
xor eax, eax
add edx, eax
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], eax
mov byte [esp + 0x2f], 1
jmp 0x4d2bdc
add eax, 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
call fcn.004b0b80
mov ecx, dword [esp + 0x70]
test ecx, ecx
jle 0x4d1ec7
lea eax, [ecx - 1]
test eax, eax
jl 0x4d1ec5
cmp eax, ecx
jge 0x4d1ec5
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + eax*4]
jmp 0x4d1ec7
xor eax, eax
cmp byte [eax + 0x8c], 0
jne 0x4d2bdc
movzx ebx, byte [eax + 0x8e]
movzx ecx, byte [eax + 0x8d]
mov esi, dword [eax + 0x88]
mov ebp, dword [eax + 4]
mov edi, dword [esp + 0x4c]
push ebx
push ecx
push 1
push esi
push ebp
push edi
mov byte [esp + 0x134], cl
call fcn.004b0f70
test eax, eax
jne 0x4d1f19
mov edx, dword [esp + 0x11c]
push ebx
push edx
push 1
push esi
push ebp
push edi
call fcn.004b0d50
push eax
mov eax, edi
call fcn.004b1120
mov edi, eax
push edi
lea esi, [esp + 0x70]
call fcn.004b4da0
mov eax, dword [edi]
mov ecx, dword [esp + 0x20]
push eax
lea esi, [edi + 0x90]
push ecx
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [esp + 0x54]
lea eax, [edi - 1]
test eax, eax
jl 0x4d1f5d
cmp eax, edi
jge 0x4d1f5d
mov edx, dword [esp + 0x50]
mov edx, dword [edx + eax*4]
jmp 0x4d1f5f
xor edx, edx
mov ecx, dword [esi + 0x10]
mov esi, dword [esi]
add ecx, esi
add edx, ecx
cmp dword [esp + 0x28], edx
jg 0x4d2bdc
test eax, eax
jl 0x4d1f8c
cmp eax, edi
jge 0x4d1f8c
mov edx, dword [esp + 0x50]
mov eax, dword [edx + eax*4]
add ecx, eax
mov dword [esp + 0x28], ecx
jmp 0x4d2bdc
xor eax, eax
add ecx, eax
mov dword [esp + 0x28], ecx
jmp 0x4d2bdc
add eax, 2
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jbe 0x4d1fc5
mov esi, dword [sym.imp.USER32.dll_CharNextW]
mov edi, edi
cmp cx, 0x20
ja 0x4d1fc5
push eax
call esi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d1fb0
cmp word [eax], 0x23
jne 0x4d1fd2
add eax, 2
mov dword [esp + 0x18], eax
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0051248d
add esp, 0xc
mov ebx, eax
push ebx
lea esi, [esp + 0x88]
call fcn.004b4da0
mov edx, ebx
shr edx, 8
movzx ecx, bl
movzx eax, dl
shl ecx, 8
or eax, ecx
shr ebx, 0x10
movzx edx, bl
shl eax, 8
or eax, edx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x4d2bdc
mov edi, dword [sym.imp.USER32.dll_CharNextW]
add eax, 2
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jbe 0x4d2047
cmp cx, 0x20
ja 0x4d2047
push eax
call edi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d2032
push 0xa
lea ecx, [esp + 0x1c]
push ecx
push eax
mov esi, eax
call fcn.0051248d
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp esi, ecx
je 0x4d2094
mov esi, dword [esp + 0x4c]
call fcn.004b10b0
mov ebp, eax
push ebp
lea esi, [esp + 0x70]
call fcn.004b4da0
mov edx, dword [ebp]
mov eax, dword [esp + 0x20]
push edx
lea esi, [ebp + 0x90]
push eax
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4d236f
lea edx, [esp + 0x320]
xor eax, eax
mov dword [esp + 0x31c], edx
mov word [esp + 0x320], ax
lea edx, [esp + 0x188]
mov dword [esp + 0x38], 0xa
mov dword [esp + 0x184], edx
mov word [esp + 0x188], ax
mov byte [esp + 0x65c], 8
mov byte [esp + 0xdc], al
mov byte [esp + 0xd4], al
mov byte [esp + 0xd0], al
movzx eax, word [ecx]
test ax, ax
je 0x4d2151
nop
cmp ax, 0x3e
je 0x4d2151
cmp ax, 0x7d
je 0x4d2151
cmp ax, 0x20
je 0x4d2151
push ecx
call edi
mov ecx, dword [esp + 0x18]
mov ebp, eax
cmp ecx, ebp
jae 0x4d2149
nop
movzx eax, word [ecx]
add ecx, 2
lea edx, [esp + 0xe8]
mov word [esp + 0xe8], ax
mov dword [esp + 0x18], ecx
push edx
lea eax, [esp + 0x320]
xor ecx, ecx
push eax
mov word [esp + 0xf2], cx
call fcn.004b4f80
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
jb 0x4d2110
movzx eax, word [ecx]
test ax, ax
jne 0x4d20f0
movzx eax, word [ecx]
test ax, ax
jbe 0x4d2177
lea esp, [esp]
cmp ax, 0x20
ja 0x4d2177
push ecx
call edi
mov ecx, eax
mov dword [esp + 0x18], ecx
movzx eax, word [ecx]
test ax, ax
ja 0x4d2160
movzx ecx, word [ecx]
push ecx
call fcn.0050db28
add esp, 4
test eax, eax
je 0x4d219f
mov eax, dword [esp + 0x18]
push 0xa
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0051248d
add esp, 0xc
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
test cx, cx
jbe 0x4d21c5
jmp 0x4d21b0
cmp cx, 0x20
ja 0x4d21c5
push eax
call edi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d21b0
movzx ecx, word [eax]
test cx, cx
je 0x4d2231
lea ecx, [ecx]
cmp cx, 0x3e
je 0x4d2231
cmp cx, 0x7d
je 0x4d2231
push eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x18]
cmp eax, ebp
jae 0x4d2229
lea esp, [esp]
movzx ecx, word [eax]
add eax, 2
lea edx, [esp + 0xcc]
mov dword [esp + 0x18], eax
mov word [esp + 0xcc], cx
push edx
lea eax, [esp + 0x188]
xor ecx, ecx
push eax
mov word [esp + 0xd6], cx
call fcn.004b4f80
mov eax, dword [esp + 0x18]
cmp eax, ebp
jb 0x4d21f0
movzx ecx, word [eax]
test cx, cx
jne 0x4d21d0
mov ecx, dword [esp + 0x184]
push ecx
call fcn.005126a9
mov edx, dword [esp + 0x188]
add esp, 4
push str.bold
push edx
call fcn.0050a835
mov ecx, dword [esp + 0x18c]
add esp, 8
test eax, eax
je 0x4d226f
sub eax, ecx
sar eax, 1
js 0x4d226f
mov byte [esp + 0xdc], 1
push str.underline
push ecx
call fcn.0050a835
mov ecx, dword [esp + 0x18c]
add esp, 8
test eax, eax
je 0x4d2296
sub eax, ecx
sar eax, 1
js 0x4d2296
mov byte [esp + 0xd4], 1
push str.italic
push ecx
call fcn.0050a835
add esp, 8
test eax, eax
je 0x4d22bb
sub eax, dword [esp + 0x184]
sar eax, 1
js 0x4d22bb
mov byte [esp + 0xd0], 1
mov esi, dword [esp + 0xd0]
mov ebp, dword [esp + 0xd4]
mov edi, dword [esp + 0xdc]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x31c]
mov ebx, dword [esp + 0x4c]
push esi
push ebp
push edi
push eax
push ecx
push ebx
call fcn.004b0f70
test eax, eax
jne 0x4d2304
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x31c]
push esi
push ebp
push edi
push edx
push eax
push ebx
call fcn.004b0d50
push eax
mov eax, ebx
call fcn.004b1120
mov ebp, eax
push ebp
lea esi, [esp + 0x70]
call fcn.004b4da0
mov ecx, dword [ebp]
mov edx, dword [esp + 0x20]
push ecx
lea esi, [ebp + 0x90]
push edx
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x184]
lea ecx, [esp + 0x188]
cmp eax, ecx
je 0x4d234c
push eax
call fcn.0050a8b9
add esp, 4
mov byte [esp + 0x65c], 6
mov eax, dword [esp + 0x31c]
lea edx, [esp + 0x320]
cmp eax, edx
je 0x4d236f
push eax
call fcn.0050a8b9
add esp, 4
mov ecx, dword [esp + 0x54]
lea eax, [ecx - 1]
test eax, eax
jl 0x4d2387
cmp eax, ecx
jge 0x4d2387
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx + eax*4]
jmp 0x4d2389
xor edx, edx
mov ecx, dword [esi + 0x10]
mov esi, dword [esi]
add ecx, esi
add edx, ecx
cmp dword [esp + 0x28], edx
jg 0x4d2bdc
test eax, eax
jl 0x4d1f8c
cmp eax, dword [esp + 0x54]
jge 0x4d1f8c
mov edx, dword [esp + 0x50]
mov eax, dword [edx + eax*4]
add ecx, eax
mov dword [esp + 0x28], ecx
jmp 0x4d2bdc
lea ecx, [eax - 2]
add eax, 2
mov dword [esp + 0x18], eax
push eax
or edx, 0xffffffff
lea eax, [esp + 0x5c8]
mov dword [esp + 0x3c], ecx
call fcn.004b4f60
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
xor ebx, ebx
cmp cx, bx
jbe 0x4d2407
cmp cx, 0x20
ja 0x4d2407
push eax
call edi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
cmp cx, bx
ja 0x4d23f2
lea edx, [esp + 0x3a8]
xor ecx, ecx
mov dword [esp + 0x3a4], edx
mov word [esp + 0x3a8], cx
mov byte [esp + 0x65c], 0xa
movzx ecx, word [eax]
cmp cx, bx
je 0x4d24a1
nop
cmp cx, 0x3e
je 0x4d2491
cmp cx, 0x7d
je 0x4d2491
cmp cx, 0x20
je 0x4d2491
push eax
call edi
mov ebp, eax
mov eax, dword [esp + 0x18]
cmp eax, ebp
jae 0x4d2489
nop
movzx ecx, word [eax]
add eax, 2
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc8]
mov word [esp + 0xc8], cx
push eax
lea ecx, [esp + 0x3a8]
xor edx, edx
push ecx
mov word [esp + 0xd2], dx
call fcn.004b4f80
mov eax, dword [esp + 0x18]
cmp eax, ebp
jb 0x4d2450
movzx ecx, word [eax]
cmp cx, bx
jne 0x4d2430
mov edx, dword [esp + 0x3a4]
cmp word [edx], bx
jne 0x4d259c
mov edi, dword [esp + 0x4c]
mov eax, edi
mov dword [esp + 0x38], ebx
call fcn.004b0b80
mov ecx, dword [esp + 0x70]
cmp ecx, ebx
jle 0x4d24ce
lea eax, [ecx - 1]
cmp eax, ebx
jl 0x4d24cc
cmp eax, ecx
jge 0x4d24cc
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + eax*4]
jmp 0x4d24ce
xor eax, eax
cmp byte [eax + 0x8e], 0
jne 0x4d2abb
movzx ebx, byte [eax + 0x8d]
movzx ecx, byte [eax + 0x8c]
mov ebp, dword [eax + 0x88]
mov esi, dword [eax + 4]
push 1
push ebx
push ecx
push ebp
push esi
push edi
mov byte [esp + 0x13c], cl
call fcn.004b0f70
test eax, eax
jne 0x4d251c
mov edx, dword [esp + 0x124]
push 1
push ebx
push edx
push ebp
push esi
push edi
call fcn.004b0d50
push eax
mov eax, edi
call fcn.004b1120
mov edi, eax
push edi
lea esi, [esp + 0x70]
call fcn.004b4da0
mov eax, dword [edi]
mov ecx, dword [esp + 0x20]
push eax
lea esi, [edi + 0x90]
push ecx
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [esp + 0x54]
lea eax, [edi - 1]
test eax, eax
jl 0x4d2560
cmp eax, edi
jge 0x4d2560
mov edx, dword [esp + 0x50]
mov ecx, dword [edx + eax*4]
jmp 0x4d2562
xor ecx, ecx
mov edx, dword [esi + 0x10]
mov esi, dword [esi]
add edx, esi
add ecx, edx
cmp dword [esp + 0x28], ecx
jg 0x4d2abb
test eax, eax
jl 0x4d258f
cmp eax, edi
jge 0x4d258f
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx + eax*4]
add edx, eax
mov dword [esp + 0x28], edx
jmp 0x4d2abb
xor eax, eax
add edx, eax
mov dword [esp + 0x28], edx
jmp 0x4d2abb
movzx ecx, word [eax]
cmp cx, bx
jbe 0x4d25b9
cmp cx, 0x20
ja 0x4d25b9
push eax
call edi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
cmp cx, bx
ja 0x4d25a4
push 0xa
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0051248d
mov esi, eax
add esp, 0xc
cmp esi, ebx
mov dword [esp + 0x60], eax
jg 0x4d25dc
mov esi, 1
mov dword [esp + 0x60], esi
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
cmp cx, bx
jbe 0x4d25fd
cmp cx, 0x20
ja 0x4d25fd
push eax
call edi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
cmp cx, bx
ja 0x4d25e8
push 0xa
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0051248d
add esp, 0xc
cmp eax, ebx
mov dword [esp + 0x90], eax
jl 0x4d261c
cmp eax, esi
jl 0x4d2623
mov dword [esp + 0x90], ebx
mov edx, dword [esp + 0x5c4]
push str.file
push edx
call fcn.0050a835
add esp, 8
test eax, eax
jne 0x4d266f
mov eax, dword [esp + 0x5c4]
push str.res
push eax
call fcn.0050a835
add esp, 8
test eax, eax
jne 0x4d266f
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x3a4]
push ebx
push ebx
push ecx
call fcn.004b11b0
mov ebp, eax
jmp 0x4d294e
lea edx, [esp + 0x540]
xor eax, eax
mov dword [esp + 0x53c], edx
mov word [esp + 0x540], ax
lea ecx, [esp + 0x430]
xor edx, edx
mov dword [esp + 0x42c], ecx
mov word [esp + 0x430], dx
mov ebp, dword [esp + 0x5c4]
lea eax, [esp + 0x210]
xor ecx, ecx
mov dword [esp + 0x20c], eax
mov word [esp + 0x210], cx
lea edx, [esp + 0x298]
xor eax, eax
mov dword [esp + 0x294], edx
mov word [esp + 0x298], ax
mov byte [esp + 0x65c], 0xe
cmp word [ebp], ax
je 0x4d28bd
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
mov edi, edi
lea edi, [esp + 0x20c]
call fcn.004b5170
lea edi, [esp + 0x294]
call fcn.004b5170
movzx eax, word [ebp]
test ax, ax
jbe 0x4d2725
cmp ax, 0x20
ja 0x4d2725
push ebp
call ebx
mov ebp, eax
movzx eax, word [ebp]
test ax, ax
ja 0x4d2711
movzx eax, word [ebp]
test ax, ax
je 0x4d277e
cmp ax, 0x3d
je 0x4d277e
cmp ax, 0x20
jbe 0x4d277e
push ebp
call ebx
mov esi, eax
cmp ebp, esi
jae 0x4d2775
mov cx, word [ebp]
lea eax, [esp + 0xc4]
mov word [esp + 0xc4], cx
push eax
lea ecx, [esp + 0x210]
xor edx, edx
push ecx
mov word [esp + 0xce], dx
call fcn.004b4f80
add ebp, 2
cmp ebp, esi
jb 0x4d2743
movzx eax, word [ebp]
test ax, ax
jne 0x4d272e
movzx eax, word [ebp]
test ax, ax
jbe 0x4d279b
cmp ax, 0x20
ja 0x4d279b
push ebp
call ebx
mov ebp, eax
movzx eax, word [ebp]
test ax, ax
ja 0x4d2787
mov dx, word [ebp]
add ebp, 2
cmp dx, 0x3d
jne 0x4d28bd
movzx eax, word [ebp]
test ax, ax
jbe 0x4d27c9
cmp ax, 0x20
ja 0x4d27c9
push ebp
call ebx
mov ebp, eax
movzx eax, word [ebp]
test ax, ax
ja 0x4d27b5
mov ax, word [ebp]
add ebp, 2
cmp ax, 0x27
jne 0x4d28bd
movzx eax, word [ebp]
test ax, ax
je 0x4d282d
cmp ax, 0x27
je 0x4d282d
push ebp
call ebx
mov esi, eax
cmp ebp, esi
jae 0x4d2824
mov cx, word [ebp]
lea eax, [esp + 0xd8]
mov word [esp + 0xd8], cx
push eax
lea ecx, [esp + 0x298]
xor edx, edx
push ecx
mov word [esp + 0xe2], dx
call fcn.004b4f80
add ebp, 2
cmp ebp, esi
jb 0x4d27f2
movzx eax, word [ebp]
test ax, ax
jne 0x4d27e3
mov dx, word [ebp]
add ebp, 2
cmp dx, 0x27
jne 0x4d28bd
mov esi, dword [esp + 0x294]
cmp word [esi], 0
je 0x4d28a5
mov ecx, 0x547468
lea eax, [esp + 0x20c]
call fcn.004b51f0
test al, al
jne 0x4d2896
mov ecx, 0x547474
lea eax, [esp + 0x20c]
call fcn.004b51f0
test al, al
jne 0x4d2896
mov ecx, str.restype
lea eax, [esp + 0x20c]
call fcn.004b51f0
test al, al
je 0x4d28a5
push 0xffffffffffffffff
push esi
lea esi, [esp + 0x544]
jmp 0x4d28a0
push 0xffffffffffffffff
push esi
lea esi, [esp + 0x434]
call fcn.004b50c0
mov ax, word [ebp]
add ebp, 2
cmp ax, 0x20
jne 0x4d28bd
cmp word [ebp], 0
jne 0x4d26f0
mov ecx, dword [esp + 0x53c]
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x42c]
push 0
push ecx
push edx
call fcn.004b11b0
mov ebp, eax
mov eax, dword [esp + 0x294]
lea ecx, [esp + 0x298]
cmp eax, ecx
je 0x4d28f5
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x20c]
lea edx, [esp + 0x210]
cmp eax, edx
je 0x4d2910
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x42c]
lea ecx, [esp + 0x430]
cmp eax, ecx
je 0x4d292b
push eax
call fcn.0050a8b9
add esp, 4
mov byte [esp + 0x65c], 0xa
mov eax, dword [esp + 0x53c]
lea edx, [esp + 0x540]
cmp eax, edx
je 0x4d294e
push eax
call fcn.0050a8b9
add esp, 4
test ebp, ebp
je 0x4d2ab3
mov ecx, dword [esp + 0x60]
cmp ecx, 1
mov ebx, dword [ebp + 4]
mov esi, dword [ebp + 8]
jle 0x4d296c
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x34]
lea ecx, [ebx + eax]
cmp ecx, dword [edx + 8]
mov dword [esp + 0x60], ecx
jle 0x4d2998
cmp eax, dword [edx]
jle 0x4d2998
test byte [esp + 0x684], 0x20
jne 0x4d2998
mov byte [esp + 0x1e], 1
jmp 0x4d2abb
cmp byte [esp + 0x1d], 0
mov dword [esp + 0x38], 0
je 0x4d2a8d
cmp byte [esp + 0x1c], 0
je 0x4d2a8d
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x44]
mov dword [esp + 0x144], eax
mov eax, ecx
sub eax, esi
cmp esi, ecx
lea edi, [eax + edx]
mov dword [esp + 0x148], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0x14c], edi
lea edi, [ecx + edx]
mov dword [esp + 0x150], edi
jge 0x4d2a05
cdq
sub eax, edx
sar eax, 1
neg eax
add edi, eax
mov dword [esp + 0x150], edi
sub edi, esi
mov dword [esp + 0x148], edi
mov ecx, dword [esp + 0x90]
xor eax, eax
mov edx, ecx
push eax
imul edx, ebx
inc ecx
push eax
imul ecx, ebx
push eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
movzx eax, byte [ebp + 0xc]
push 0xff
push eax
mov eax, dword [ebp]
mov dword [esp + 0x180], ecx
lea ecx, [esp + 0x158]
push ecx
mov dword [esp + 0x17c], edx
mov edx, ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
lea eax, [esp + 0x198]
lea edi, [esp + 0x188]
mov dword [esp + 0x194], esi
call fcn.004cece0
mov ecx, dword [esp + 0x84]
add esp, 0x24
cmp esi, dword [esp + 0x28]
jle 0x4d2a97
mov dword [esp + 0x28], esi
mov edx, dword [esp + 0x44]
add esi, edx
cmp dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x64], esi
jg 0x4d2abb
mov eax, ecx
mov dword [esp + 0x3c], eax
jmp 0x4d2abb
mov dword [esp + 0x38], 0
mov eax, dword [esp + 0x3a4]
lea ecx, [esp + 0x3a8]
cmp eax, ecx
je 0x4d2ad6
push eax
call fcn.0050a8b9
add esp, 4
mov byte [esp + 0x65c], 6
mov eax, dword [esp + 0x5c4]
lea edx, [esp + 0x5c8]
cmp eax, edx
je 0x4d2af9
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4d2bdc
mov dword [esp + 0x18], eax
jmp 0x4d371f
add eax, 2
test byte [esp + 0x684], 0x20
mov dword [esp + 0x18], eax
jne case.0x4d1c6f.100
mov byte [esp + 0x1e], 1
jmp case.0x4d1c6f.100
mov ecx, dword [esp + 0x34]
add eax, 2
cmp edi, dword [ecx]
mov dword [esp + 0x18], eax
jle 0x4d2b41
mov byte [esp + 0x1e], 1
movzx ecx, word [eax]
test cx, cx
jbe 0x4d2b65
mov esi, dword [sym.imp.USER32.dll_CharNextW]
nop
cmp cx, 0x20
ja 0x4d2b65
push eax
call esi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d2b50
push 0xa
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0051248d
add esp, 0xc
mov edi, eax
push edi
lea esi, [esp + 0x54]
call fcn.004b4da0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax]
mov eax, dword [esp + 0x18]
add edi, ecx
cmp dword [esp + 0x28], edi
jg case.0x4d1c6f.100
mov dword [esp + 0x28], edi
jmp case.0x4d1c6f.100
add eax, 2
mov dword [esp + 0x18], eax
mov byte [esp + 0x1f], 1
jmp case.0x4d1c6f.100
add eax, 2
cmp byte [esp + 0x27], 0
mov dword [esp + 0x18], eax
sete cl
cmp byte [esp + 0x1d], 0
mov byte [esp + 0x27], cl
je case.0x4d1c6f.100
cmp byte [esp + 0x1c], 0
je case.0x4d1c6f.100
test cl, cl
je 0x4d2c17
mov edx, dword [esp + 0x20]
push 2
push edx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
test cx, cx
je 0x4d2c0b
mov edi, edi
cmp cx, 0x3e
je 0x4d2c0b
cmp cx, 0x7d
je 0x4d2c0b
push eax
call esi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jne 0x4d2bf0
push eax
call esi
mov dword [esp + 0x18], eax
jmp 0x4d371f
mov eax, dword [esp + 0x20]
push 1
push eax
jmp 0x4d2bd6
mov edi, dword [esp + 0x4c]
add eax, 2
mov dword [esp + 0x18], eax
mov eax, edi
call fcn.004b0b80
mov ecx, dword [esp + 0x70]
test ecx, ecx
jle 0x4d2c50
lea eax, [ecx - 1]
test eax, eax
jl 0x4d2c4e
cmp eax, ecx
jge 0x4d2c4e
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + eax*4]
jmp 0x4d2c50
xor eax, eax
cmp byte [eax + 0x8d], 0
jne 0x4d2bdc
movzx ebx, byte [eax + 0x8e]
movzx ecx, byte [eax + 0x8c]
mov ebp, dword [eax + 0x88]
mov esi, dword [eax + 4]
push ebx
push 1
push ecx
push ebp
push esi
push edi
mov byte [esp + 0x144], cl
call fcn.004b0f70
test eax, eax
jne 0x4d2c9a
mov edx, dword [esp + 0x12c]
push ebx
push 1
push edx
push ebp
push esi
push edi
call fcn.004b0d50
push eax
mov eax, edi
call fcn.004b1120
mov edi, eax
push edi
lea esi, [esp + 0x70]
call fcn.004b4da0
mov eax, dword [edi]
mov ecx, dword [esp + 0x20]
push eax
lea esi, [edi + 0x90]
push ecx
mov dword [esp + 0x38], esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, dword [esp + 0x54]
lea eax, [edi - 1]
test eax, eax
jl 0x4d1f5d
cmp eax, edi
jge 0x4d1f5d
mov edx, dword [esp + 0x50]
mov edx, dword [edx + eax*4]
jmp 0x4d1f5f
add eax, 2
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jbe 0x4d2d11
cmp cx, 0x20
ja 0x4d2d11
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d2cf8
push 0xa
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0051248d
add edi, eax
add esp, 0xc
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
jg 0x4d2bdc
mov dword [esp + 0x3c], edi
jmp 0x4d2bdc
add eax, 2
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jbe 0x4d2d69
lea esp, [esp]
cmp cx, 0x20
ja 0x4d2d69
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
ja 0x4d2d50
push 0xa
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0051248d
add esp, 0xc
mov dword [esp + 0x28], eax
jmp 0x4d2bdc
cmp cx, 0x3c
je 0x4d2d92
cmp cx, 0x7b
jne 0x4d30db
cmp word [eax + 2], 0x2f
jne 0x4d30db
add eax, 4
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
add ecx, 0xffffff9f
cmp ecx, 0x14
ja case.0x4d2dba.100
movzx ecx, byte [ecx + 0x4d3b10]
jmp dword [ecx*4 + 0x4d3af8]
mov edx, dword [esp + 0x88]
add eax, 2
lea ecx, [edx - 1]
mov dword [esp + 0x18], eax
test ecx, ecx
jl 0x4d2de9
lea edx, [esp + 0x84]
call fcn.004b4ea0
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x674]
test edx, edx
jle 0x4d2e0d
lea eax, [edx - 1]
test eax, eax
jl 0x4d2e0b
cmp eax, edx
jge 0x4d2e0b
mov edx, dword [esp + 0x84]
mov eax, dword [edx + eax*4]
jmp 0x4d2e0d
xor eax, eax
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0x20]
shr eax, 0x10
movzx eax, al
shl edx, 8
or edx, eax
push edx
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x4d30a2
mov edx, dword [esp + 0x34]
add eax, 2
cmp edi, dword [edx]
mov dword [esp + 0x18], eax
jle 0x4d2e4d
mov byte [esp + 0x1e], 1
mov edx, dword [esp + 0x54]
lea ecx, [edx - 1]
test ecx, ecx
jl 0x4d2e69
lea edx, [esp + 0x50]
call fcn.004b4ea0
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
lea ecx, [edx - 1]
test ecx, ecx
jl 0x4d2e7d
cmp ecx, edx
jge 0x4d2e7d
mov edx, dword [esp + 0x50]
mov edx, dword [edx + ecx*4]
jmp 0x4d2e7f
xor edx, edx
mov esi, dword [esp + 0x30]
mov edi, dword [esi + 0x10]
mov esi, dword [esi]
add esi, edi
add edx, esi
cmp dword [esp + 0x28], edx
jg case.0x4d2dba.100
test ecx, ecx
jl 0x4d2eb2
cmp ecx, dword [esp + 0x54]
jge 0x4d2eb2
mov edx, dword [esp + 0x50]
mov ecx, dword [edx + ecx*4]
add esi, ecx
mov dword [esp + 0x28], esi
jmp case.0x4d2dba.100
xor ecx, ecx
add esi, ecx
mov dword [esp + 0x28], esi
jmp case.0x4d2dba.100
add eax, 2
cmp byte [esp + 0x27], 0
mov dword [esp + 0x18], eax
sete cl
cmp byte [esp + 0x1d], 0
mov byte [esp + 0x27], cl
je case.0x4d2dba.100
cmp byte [esp + 0x1c], 0
je case.0x4d2dba.100
test cl, cl
je 0x4d2efe
mov eax, dword [esp + 0x20]
push 2
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
jmp 0x4d30a2
mov ecx, dword [esp + 0x20]
push 1
push ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
jmp 0x4d30a2
mov edx, dword [esp + 0x78]
cmp ebp, dword [edx]
jge 0x4d2f57
cmp byte [esp + 0x1c], 0
jne 0x4d2f4f
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax]
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0x94]
add ecx, ebx
push ecx
push edi
mov ecx, ebp
push edx
shl ecx, 4
add ecx, dword [esp + 0xb0]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetRect]
inc ebp
mov dword [esp + 0x80], ebp
mov edx, dword [esp + 0x88]
lea ecx, [edx - 1]
test ecx, ecx
jl 0x4d2f78
lea edx, [esp + 0x84]
call fcn.004b4ea0
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x674]
test edx, edx
jle 0x4d2f9c
lea eax, [edx - 1]
test eax, eax
jl 0x4d2f9a
cmp eax, edx
jge 0x4d2f9a
mov edx, dword [esp + 0x84]
mov eax, dword [edx + eax*4]
jmp 0x4d2f9c
xor eax, eax
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0x20]
shr eax, 0x10
movzx eax, al
shl edx, 8
or edx, eax
push edx
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x2f], 0
mov edx, dword [esp + 0x70]
add eax, 2
lea ecx, [edx - 1]
mov dword [esp + 0x18], eax
test ecx, ecx
jl 0x4d2feb
lea edx, [esp + 0x6c]
call fcn.004b4ea0
mov edx, dword [esp + 0x70]
lea eax, [edx - 1]
test eax, eax
jl 0x4d3001
cmp eax, edx
jge 0x4d3001
mov edx, dword [esp + 0x6c]
mov esi, dword [edx + eax*4]
test esi, esi
jne 0x4d300c
mov eax, dword [esp + 0x4c]
call fcn.004b0b80
mov esi, eax
mov eax, dword [esp + 0x30]
cmp byte [eax + 0x34], 0
je 0x4d3048
cmp byte [esi + 0x8e], 0
jne 0x4d3048
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0xb4]
push ecx
push 0x20
push 0x20
push edx
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov eax, dword [esp + 0xbc]
cdq
sub eax, edx
sar eax, 1
add edi, eax
mov dword [esp + 0x40], edi
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
push eax
lea edi, [esi + 0x90]
push ecx
mov dword [esp + 0x38], edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [esp + 0x54]
lea eax, [esi - 1]
test eax, eax
jl 0x4d3078
cmp eax, esi
jge 0x4d3078
mov edx, dword [esp + 0x50]
mov ecx, dword [edx + eax*4]
jmp 0x4d307a
xor ecx, ecx
mov edx, dword [edi + 0x10]
mov edi, dword [edi]
add edx, edi
add ecx, edx
cmp dword [esp + 0x28], ecx
jg 0x4d30a2
test eax, eax
jl 0x4d309a
cmp eax, esi
jge 0x4d309a
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx + eax*4]
jmp 0x4d309c
xor eax, eax
add edx, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
test cx, cx
je 0x4d30cf
cmp cx, 0x3e
je 0x4d30cf
cmp cx, 0x7d
je 0x4d30cf
push eax
call esi
mov dword [esp + 0x18], eax
movzx ecx, word [eax]
test cx, cx
jne 0x4d30b4
push eax
call esi
mov dword [esp + 0x18], eax
jmp 0x4d371f
cmp cx, 0x3c
jne 0x4d3161
cmp word [eax + 4], 0x3e
jne 0x4d3161
movzx ebp, word [eax + 2]
lea esi, [eax + 2]
cmp bp, 0x7b
je 0x4d30ff
cmp bp, 0x7d
jne 0x4d3161
lea edx, [esp + 0x134]
push edx
push 1
push esi
mov esi, dword [esp + 0x2c]
xor eax, eax
push esi
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
cmp byte [esp + 0x1d], 0
je 0x4d3155
cmp byte [esp + 0x1c], 0
je 0x4d3155
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x7c]
push 1
add eax, 2
push eax
mov eax, dword [esp + 0x38]
sub ecx, dword [eax + 0x10]
sub ecx, dword [eax]
add ecx, ebx
push ecx
push edi
push esi
call dword [sym.imp.GDI32.dll_TextOutW]
add edi, dword [esp + 0x134]
jmp 0x4d31e6
cmp cx, 0x7b
jne 0x4d3204
cmp word [eax + 4], 0x7d
jne 0x4d3204
movzx ebp, word [eax + 2]
lea esi, [eax + 2]
cmp bp, 0x3c
je 0x4d3189
cmp bp, 0x3e
jne 0x4d3204
lea edx, [esp + 0x13c]
push edx
push 1
push esi
mov esi, dword [esp + 0x2c]
xor eax, eax
push esi
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
cmp byte [esp + 0x1d], 0
je 0x4d31df
cmp byte [esp + 0x1c], 0
je 0x4d31df
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x7c]
push 1
add eax, 2
push eax
mov eax, dword [esp + 0x38]
sub ecx, dword [eax + 0x10]
sub ecx, dword [eax]
add ecx, ebx
push ecx
push edi
push esi
call dword [sym.imp.GDI32.dll_TextOutW]
add edi, dword [esp + 0x13c]
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
jg 0x4d31f4
mov dword [esp + 0x3c], edi
mov eax, dword [esp + 0x18]
add eax, 6
mov dword [esp + 0x18], eax
jmp 0x4d371f
cmp cx, 0x20
jne 0x4d328a
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x110]
push edx
push 1
xor eax, eax
push 0x5474fc
push esi
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
cmp byte [esp + 0x1d], 0
je 0x4d3265
cmp byte [esp + 0x1c], 0
je 0x4d3265
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x7c]
sub ecx, dword [eax + 0x10]
push 1
sub ecx, dword [eax]
push 0x5474fc
add ecx, ebx
push ecx
push edi
push esi
call dword [sym.imp.GDI32.dll_TextOutW]
add edi, dword [esp + 0x110]
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
jg 0x4d327a
mov dword [esp + 0x3c], edi
mov eax, dword [esp + 0x18]
add eax, 2
mov dword [esp + 0x18], eax
jmp 0x4d371f
mov dword [esp + 0xa8], edi
xor edi, edi
mov dword [esp + 0xac], ebx
xor ebp, ebp
xor ebx, ebx
cmp byte [esp + 0x1f], 0
mov dword [esp + 0x38], edi
mov dword [esp + 0x60], edi
mov esi, eax
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
jne 0x4d32c3
cmp word [eax], 0x3c
je 0x4d32c9
cmp word [eax], 0x7b
jne 0x4d32d3
mov ebp, 1
lea esi, [eax + 2]
mov ebx, ebp
movzx ecx, word [esi]
cmp cx, di
je 0x4d3467
nop
cmp cx, 0xa
je 0x4d3467
cmp byte [esp + 0x1f], 0
je 0x4d3325
cmp cx, 0x3c
je 0x4d32fd
cmp cx, 0x7b
jne 0x4d3339
cmp word [esi + 2], 0x2f
jne 0x4d3339
cmp word [esi + 4], 0x72
jne 0x4d3339
movzx ecx, word [esi + 6]
cmp cx, 0x3e
je 0x4d331b
cmp cx, 0x7d
jne 0x4d3339
mov byte [esp + 0x1f], 0
jmp 0x4d3467
cmp cx, 0x3c
je 0x4d3467
cmp cx, 0x7b
je 0x4d3467
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov ecx, dword [esp + 0x40]
mov edi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 0x18]
inc ebp
imul eax, ebp
mov edx, edi
sub edx, esi
sar edx, 1
add ebx, edx
lea edx, [eax + ecx]
mov ecx, dword [esp + 0x34]
cmp edx, dword [ecx + 8]
mov dword [esp + 0x9c], eax
jl 0x4d338c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x9c]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov eax, dword [esp + 0x9c]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
add edx, eax
cmp edx, dword [ecx + 8]
jg 0x4d33ea
movzx eax, word [esi]
cmp ax, 0x61
jb 0x4d33aa
cmp ax, 0x7a
jbe 0x4d33be
cmp ax, 0x41
jb 0x4d33b6
cmp ax, 0x5a
jbe 0x4d33be
mov dword [esp + 0x38], ebp
mov dword [esp + 0x60], ebx
cmp ax, 0x20
jne 0x4d33cc
mov dword [esp + 0x38], ebp
mov dword [esp + 0x60], ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
movzx ecx, word [esi]
mov eax, dword [esp + 0x18]
test cx, cx
jne 0x4d32e0
jmp 0x4d3467
mov edx, dword [esp + 0x40]
add eax, edx
cmp eax, dword [ecx + 8]
jle 0x4d3400
cmp edx, dword [ecx]
je 0x4d3400
sub edi, esi
sar edi, 1
dec ebp
sub ebx, edi
mov ecx, dword [esp + 0x684]
test cl, 0x10
je 0x4d341a
mov eax, dword [esp + 0x38]
test eax, eax
jle 0x4d341a
mov ebx, dword [esp + 0x60]
mov ebp, eax
test ecx, 0x8000
je 0x4d3454
test ebp, ebp
jle 0x4d3454
mov eax, dword [esp + 0x18]
mov edi, dword [sym.imp.USER32.dll_CharPrevW]
push esi
push eax
call edi
dec ebp
test ebp, ebp
jle 0x4d3441
mov ecx, dword [esp + 0x18]
push eax
push ecx
call edi
mov edx, dword [esp + 0x34]
sub esi, eax
mov eax, dword [edx + 8]
sar esi, 1
sub ebx, esi
mov dword [esp + 0x40], eax
mov edx, eax
cmp dword [esp + 0x3c], edx
mov eax, dword [esp + 0x18]
mov byte [esp + 0x1e], 1
jg 0x4d3467
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x9c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
cmp byte [esp + 0x1d], 0
je 0x4d3557
cmp byte [esp + 0x1c], 0
je 0x4d3557
mov ecx, dword [esp + 0x684]
mov eax, ecx
and eax, 0x20
jne 0x4d34c9
cmp dword [esp + 0x120], eax
je 0x4d34c9
mov edi, dword [esp + 0x34]
mov eax, dword [edi + 8]
sub eax, dword [esp + 0x9c]
mov esi, dword [esp + 0xa8]
sub eax, dword [edi]
cdq
sub eax, edx
sar eax, 1
add esi, eax
jmp 0x4d34f8
test eax, eax
jne 0x4d34ed
test cl, 2
je 0x4d34ed
mov edi, dword [esp + 0x34]
mov eax, dword [edi + 8]
sub eax, dword [esp + 0x9c]
mov esi, dword [esp + 0xa8]
sub eax, dword [edi]
add esi, eax
jmp 0x4d34f8
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0xa8]
mov ebp, dword [esp + 0xac]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
mov edx, ebp
sub edx, dword [eax + 0x10]
push ebx
sub edx, dword [eax]
mov eax, dword [esp + 0x24]
add edx, dword [esp + 0x80]
push ecx
push edx
push esi
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
mov ecx, dword [esp + 0x40]
cmp ecx, dword [edi + 8]
jl 0x4d3557
test dword [esp + 0x684], 0x8000
je 0x4d3557
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x20]
push 3
push 0x547500
push ebp
add esi, edx
push esi
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
mov eax, dword [esp + 0x40]
add eax, dword [esp + 0x9c]
cmp dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
jg 0x4d3570
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x18]
lea eax, [ecx + ebx*2]
mov dword [esp + 0x18], eax
jmp 0x4d371f
cmp cx, 0xa
jne 0x4d358d
add eax, 2
mov dword [esp + 0x18], eax
test dl, dl
je 0x4d3596
mov byte [esp + 0x1e], 0
cmp byte [esp + 0x1c], 0
jne 0x4d3658
cmp byte [esp + 0x2f], 0
je 0x4d3610
mov edx, dword [esp + 0x78]
cmp ebp, dword [edx]
jge 0x4d3610
cmp edi, esi
mov ecx, edi
jl 0x4d35b8
mov ecx, esi
mov edx, dword [esp + 0x28]
add edx, ebx
push edx
mov edx, dword [esp + 0x98]
push ecx
mov ecx, dword [esp + 0xa0]
mov eax, ebp
shl eax, 4
add eax, dword [esp + 0xac]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, dword [esp + 0xb0]
inc ebp
mov eax, ebp
imul eax, eax, 0x84
mov edx, dword [eax + ecx - 0x84]
lea esi, [eax + ecx]
push 0xffffffffffffffff
push edx
mov dword [esp + 0x88], ebp
call fcn.004b50c0
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x68]
cmp edi, ebp
jge 0x4d363d
mov ecx, dword [esp + 0x28]
lea esi, [ecx + ebx]
mov ecx, dword [esp + 0xa4]
mov edx, edi
shl edx, 4
lea edx, [edx + ecx + 0xc]
mov ecx, ebp
sub ecx, edi
mov dword [edx], esi
add edx, 0x10
sub ecx, 1
jne 0x4d3633
mov cl, byte [esp + 0x1d]
test cl, cl
je 0x4d367c
mov dl, byte [esp + 0x5e]
mov ebp, edi
mov byte [esp + 0x2f], dl
mov dword [esp + 0x80], ebp
jmp 0x4d367c
mov cl, byte [esp + 0x2f]
test cl, cl
je 0x4d3670
mov edx, dword [esp + 0x78]
cmp ebp, dword [edx]
jge 0x4d3670
inc ebp
mov dword [esp + 0x80], ebp
mov byte [esp + 0x5e], cl
mov cl, byte [esp + 0x1d]
mov dword [esp + 0x68], ebp
test byte [esp + 0x684], 0x20
je 0x4d36a1
test cl, cl
je 0x4d38bc
cmp byte [esp + 0x1c], 0
jne 0x4d38bc
mov ebx, dword [esp + 0x44]
mov cl, byte [esp + 0x1d]
test cl, cl
je 0x4d36b1
cmp byte [esp + 0x1c], 0
sete dl
mov byte [esp + 0x1c], dl
cmp byte [esp + 0x1c], 0
mov esi, dword [esp + 0x34]
mov edi, dword [esi]
mov dword [esp + 0x40], edi
jne 0x4d36ca
add ebx, dword [esp + 0x28]
mov dword [esp + 0x44], ebx
cmp ebx, dword [esi + 0xc]
jle 0x4d36db
test cl, cl
jne 0x4d38bc
mov ebx, dword [esp + 0x44]
mov edx, dword [esp + 0x54]
lea ecx, [edx - 1]
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], ebx
test ecx, ecx
jl 0x4d3701
cmp ecx, edx
jge 0x4d3701
mov edx, dword [esp + 0x50]
mov esi, dword [edx + ecx*4]
jmp 0x4d3703
xor esi, esi
mov edx, dword [esp + 0x30]
mov ecx, dword [edx + 0x10]
add ecx, dword [edx]
add ecx, esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
cmp edi, dword [ecx + 8]
jge 0x4d38b5
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x34]
cmp edx, dword [ecx + 8]
jge 0x4d373a
movzx ecx, word [eax]
cmp cx, 0xa
je 0x4d373a
test cx, cx
jne 0x4d373f
mov byte [esp + 0x1e], 1
cmp byte [esp + 0x1d], 0
je 0x4d38a9
cmp byte [esp + 0x1e], 0
je 0x4d38a9
cmp byte [esp + 0x1c], 0
jne 0x4d39f7
mov edi, dword [esp + 0x108]
push edi
lea esi, [esp + 0x70]
call fcn.004b4d50
mov eax, dword [esp + 0x104]
mov ebx, dword [esp + 0x6c]
lea edx, [edi*4]
push edx
push eax
push ebx
call fcn.00510c60
mov edi, dword [esp + 0x108]
add esp, 0xc
push edi
lea esi, [esp + 0x88]
call fcn.004b4d50
mov edx, dword [esp + 0xf8]
mov ebp, dword [esp + 0x84]
lea ecx, [edi*4]
push ecx
push edx
push ebp
call fcn.00510c60
mov edi, dword [esp + 0xfc]
add esp, 0xc
push edi
lea esi, [esp + 0x54]
call fcn.004b4d50
mov ecx, dword [esp + 0xec]
mov edx, dword [esp + 0x50]
lea eax, [edi*4]
push eax
push ecx
push edx
call fcn.00510c60
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xf0]
mov dl, byte [esp + 0x6b]
mov dword [esp + 0x88], eax
mov al, byte [esp + 0x56]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x94]
add esp, 0xc
mov byte [esp + 0x27], al
mov eax, dword [esp + 0x674]
mov byte [esp + 0x1f], dl
test ecx, ecx
jle 0x4d383b
lea eax, [ecx - 1]
test eax, eax
jl 0x4d3839
cmp eax, ecx
jge 0x4d3839
mov eax, dword [ebp + eax*4]
jmp 0x4d383b
xor eax, eax
mov esi, dword [esp + 0x20]
mov ecx, eax
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl ecx, 8
shr eax, 0x10
or edx, ecx
movzx eax, al
shl edx, 8
or edx, eax
push edx
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x70]
lea eax, [ecx - 1]
test eax, eax
jl 0x4d3878
cmp eax, ecx
jge 0x4d3878
mov eax, dword [ebx + eax*4]
test eax, eax
jne 0x4d3881
mov eax, dword [esp + 0x4c]
call fcn.004b0b80
mov edx, dword [eax]
push edx
lea ecx, [eax + 0x90]
push esi
mov dword [esp + 0x38], ecx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp byte [esp + 0x4a], 0
je 0x4d38a5
push 2
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esp + 0x18]
movzx ecx, word [eax]
test cx, cx
jne 0x4d1bd0
mov ebp, dword [esp + 0x80]
test dword [esp + 0x684], 0x400
mov eax, dword [esp + 0x78]
mov dword [eax], ebp
je 0x4d38fb
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x44]
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x64]
cmp ecx, eax
jle 0x4d38e4
mov eax, ecx
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 8]
cmp eax, edx
jl 0x4d38f8
mov eax, edx
mov dword [ecx + 8], eax
cmp byte [esp + 0x1d], 0
je 0x4d3915
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov edx, dword [esp + 0xe0]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push edx
call esi
mov eax, dword [esp + 0x130]
push eax
call esi
mov ecx, dword [esp + 0x128]
mov edx, dword [esp + 0x20]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0xec]
test eax, eax
je 0x4d3956
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x4d396a
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x104]
test eax, eax
je 0x4d397e
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x4b4]
lea ecx, [esp + 0x4b8]
cmp eax, ecx
je 0x4d3999
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x50]
test eax, eax
je 0x4d39aa
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4d39be
push eax
call fcn.0050a8b9
add esp, 4
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x4d39cf
push eax
call fcn.0050a8b9
add esp, 4
mov ecx, dword [esp + 0x654]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x638]
xor ecx, esp
call fcn.0050a231
add esp, 0x64c
ret
mov edi, dword [esp + 0x70]
push edi
lea esi, [esp + 0x108]
call fcn.004b4d50
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x104]
lea eax, [edi*4]
push eax
push ecx
push edx
call fcn.00510c60
mov edi, dword [esp + 0x94]
add esp, 0xc
push edi
lea esi, [esp + 0xfc]
call fcn.004b4d50
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0xf8]
lea eax, [edi*4]
push eax
push ecx
push edx
call fcn.00510c60
mov edi, dword [esp + 0x60]
add esp, 0xc
push edi
lea esi, [esp + 0xf0]
call fcn.004b4d50
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0xec]
lea eax, [edi*4]
push eax
push ecx
push edx
call fcn.00510c60
mov eax, dword [esp + 0x24]
mov cl, byte [esp + 0x33]
mov dl, byte [esp + 0x2b]
add esp, 0xc
mov dword [esp + 0xe4], eax
mov byte [esp + 0x4a], cl
mov byte [esp + 0x5f], dl
jmp 0x4d38a9