Function at 0x4bf300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x55359f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x90]
push edi
push eax
xor edi, edi
push 0x5a454c
mov dword [esp + 0x7c], edi
mov dword [esp + 0xac], edi
call fcn.00526a01
lea ecx, [esp + 0x80]
mov esi, eax
push ecx
mov dword [esp + 0x3c], esi
call fcn.0053e3e0
add esp, 0xc
cmp esi, edi
je 0x4bf3c5
mov ecx, dword [esi + 0xa0c]
cmp ecx, edi
je 0x4bf3c5
cmp dword [ecx + 0x7f8], edi
je 0x4bf3c5
call fcn.004bdbf0
mov ebp, eax
cmp ebp, edi
mov dword [esp + 0xa4], ebp
je 0x4bf3c5
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
lea eax, [esp + 0x18]
push eax
xor esi, esi
call dword [edx + 0x398]
mov ecx, dword [eax]
mov edx, dword [esp + 0x78]
mov eax, dword [eax + 4]
cmp edx, ecx
mov ecx, dword [esp + 0x7c]
jne 0x4bf3a5
cmp ecx, eax
je 0x4bf3a9
mov esi, edx
mov edi, ecx
push 0
push edi
push esi
lea ecx, [esp + 0xbc]
push ecx
mov ecx, ebp
call fcn.0048d740
mov dword [esp + 0xd4], ebp
xor edi, edi
mov esi, dword [ebx + 8]
call fcn.004b27d0
mov eax, dword [eax + 0x5c]
cmp eax, edi
je 0x4bf3df
cmp dword [eax + 8], esi
je 0x4bf3e1
mov eax, dword [eax]
cmp eax, edi
jne 0x4bf3d4
xor eax, eax
mov ecx, dword [0x5a8774]
xor edx, edx
cmp eax, edi
setne dl
cmp ecx, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edx
je 0x4bf40c
cmp dword [ebx + 4], edi
jne 0x4bf40c
mov eax, dword [ebx + 8]
push eax
call fcn.004a55a0
mov dword [esp + 0x14], eax
call fcn.004901b0
cmp dword [esp + 0xd8], edi
mov ecx, dword [0x5a7af4]
mov edx, dword [0x5a7af8]
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], edx
mov ebp, 1
je 0x4bf542
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x5c]
test eax, eax
je 0x4bf54f
mov dword [esp + 0x44], edi
cmp dword [ebx + 0x8c], edi
je 0x4bf467
cmp dword [ebx + 0xa0], edi
jne 0x4bf467
mov dword [esp + 0xdc], ebp
mov eax, dword [ebx + 8]
cmp eax, edi
mov esi, dword [esp + 0xcc]
mov dword [esp + 0xa0], edi
je 0x4bf4ac
cmp eax, 0xffffffff
je 0x4bf4ac
cmp dword [ebx + 0xa4], edi
jne 0x4bf4ac
mov ecx, dword [esp + 0x30]
cmp ecx, edi
je 0x4bf4ac
cmp dword [ecx + 0xa10], eax
jne 0x4bf4ac
mov edx, dword [esi]
push 0x5a7a3c
mov ecx, esi
call dword [edx + 0x28]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xd0]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
call fcn.0047a8f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x130]
add dword [esp + 0x34], eax
call fcn.0047a8f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x130]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x78]
add eax, ecx
add eax, edx
mov edx, dword [esp + 0x40]
push 0xffffffffffffffff
mov dword [esp + 0x40], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x68], ecx
mov ecx, dword [esp + 0x3c]
push ebp
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x7c], edx
call dword [sym.imp.user32.dll_InflateRect]
cmp dword [0x5a465c], edi
je 0x4bf53e
mov ecx, dword [ebx + 8]
push ecx
call fcn.00542190
add esp, 4
test eax, eax
jne 0x4bf558
xor ebp, ebp
jmp 0x4bf5a8
test dword [ebx + 0xc], 0x40000
je 0x4bf44c
mov dword [esp + 0x44], ebp
jmp 0x4bf450
mov edx, dword [ebx + 0x90]
push edx
xor ebp, ebp
push 0x5a454c
mov dword [esp + 0x38], ebp
call fcn.00526a01
add esp, 8
cmp eax, edi
je 0x4bf5ac
mov eax, dword [eax + 0x1c]
push eax
call dword [sym.imp.user32.dll_GetParent]
push eax
call fcn.0052220f
push eax
push 0x5a4314
call fcn.00526a01
add esp, 8
cmp eax, edi
je 0x4bf5ac
mov ecx, eax
call fcn.00488ae0
test eax, eax
je 0x4bf5ac
mov ebp, 1
mov dword [esp + 0x30], ebp
cmp dword [esp + 0xdc], edi
mov dword [esp + 0x2c], edi
jne 0x4bf5ce
call fcn.0047a8f0
cmp dword [eax + 0x18], edi
je 0x4bf5ce
mov edx, 1
mov dword [esp + 0x58], edx
jmp 0x4bf5d7
mov dword [esp + 0x58], edi
mov edx, 1
cmp ebp, edi
je 0x4bf612
cmp dword [esp + 0xdc], edi
mov dword [esp + 0x2c], edx
mov ecx, 0x110000
je 0x4bf5f6
test dword [ebx + 0xc], ecx
je 0x4bf5f6
mov dword [esp + 0x2c], edi
cmp dword [ebx + 4], edi
je 0x4bf600
mov eax, dword [ebx + 0x44]
jmp 0x4bf603
mov eax, dword [ebx + 0x40]
cmp eax, edi
jge 0x4bf62d
test dword [ebx + 0xc], ecx
jne 0x4bf62d
mov dword [esp + 0x2c], edi
jmp 0x4bf62d
test dword [ebx + 0xc], 0x110000
je 0x4bf62d
mov eax, dword [esp + 0xdc]
xor ecx, ecx
cmp eax, edi
sete cl
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebx + 0x18]
cmp ecx, edi
je 0x4bf645
cmp dword [ebx + 4], edi
je 0x4bf63e
mov eax, dword [ebx + 0x44]
jmp 0x4bf641
mov eax, dword [ebx + 0x40]
cmp eax, edi
jge 0x4bf661
mov eax, dword [ebx + 4]
mov dword [ebx + 0x18], edx
mov dword [ebx + 4], edx
cmp dword [ebx + 0x44], edi
jge 0x4bf661
cmp dword [ebx + 0x40], edi
mov dword [ebx + 4], edi
jge 0x4bf661
mov dword [ebx + 0x18], ecx
mov dword [ebx + 4], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xa8], vtable.CRgn.0
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0xc8], edi
call dword [sym.imp.gdi32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0xac]
call fcn.00528920
mov ebp, dword [esp + 0xdc]
push ebp
lea eax, [esp + 0x68]
push eax
push esi
mov ecx, ebx
call fcn.004b0b00
cmp dword [esp + 0x48], edi
jne 0x4bf96b
cmp dword [ebx + 0x18], edi
je 0x4bf96b
cmp dword [ebx + 4], edi
je 0x4bf6c8
mov eax, dword [ebx + 0x44]
jmp 0x4bf6cb
mov eax, dword [ebx + 0x40]
cmp eax, edi
jl 0x4bf96b
cmp dword [esp + 0xd4], edi
je 0x4bf96b
cmp ebp, edi
je 0x4bf708
cmp dword [esp + 0xd8], edi
jne 0x4bf708
call fcn.0047a8f0
cmp dword [eax + 0x10], edi
je 0x4bf708
test dword [ebx + 0xc], 0x50000
mov dword [esp + 0x10], 1
je 0x4bf70c
mov dword [esp + 0x10], edi
lea ecx, [esp + 0xa8]
push ecx
mov ecx, esi
call fcn.005280be
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x7c]
sub eax, ecx
sub eax, ebp
mov ebp, dword [esp + 0x34]
cdq
sub eax, edx
mov edx, dword [esp + 0x78]
sar eax, 1
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x3c]
sub eax, ebp
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x48]
mov edi, eax
mov eax, dword [ebx + 0xc]
sar edi, 1
test eax, 0x10000
mov dword [esp + 0x54], edx
je 0x4bf786
mov eax, dword [esp + 0xd8]
test eax, eax
jne 0x4bf786
call fcn.0047a8f0
mov ecx, dword [eax + 0x10]
mov ebp, dword [esp + 0x34]
test ecx, ecx
mov ecx, dword [esp + 0x38]
jne 0x4bf786
mov eax, dword [esp + 0x48]
inc edi
inc eax
mov dword [esp + 0x54], eax
mov eax, dword [ebx + 0xc]
test eax, 0x20000
jne 0x4bf7b1
test eax, 0x40000
je 0x4bf7b1
mov eax, dword [esp + 0xe0]
test eax, eax
je 0x4bf7b1
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x4bf880
mov eax, dword [esp + 0x14]
add ebp, edi
test eax, eax
mov eax, dword [esp + 0x54]
je 0x4bf7f0
mov edx, dword [esp + 0x78]
add ecx, eax
mov eax, ebp
add edx, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7c]
add eax, ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], eax
call fcn.004e6310
jmp 0x4bf85c
add ecx, eax
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x4c], ecx
je 0x4bf833
mov eax, dword [ebx + 4]
test eax, eax
je 0x4bf80a
mov eax, dword [ebx + 0x44]
jmp 0x4bf80d
mov eax, dword [ebx + 0x40]
push 0
push 1
push 0
push 0
push 0
push eax
push ecx
mov ecx, dword [esp + 0xf0]
push ebp
push esi
call fcn.0048e450
mov eax, dword [esp + 0x4c]
dec ebp
dec eax
mov dword [esp + 0x4c], eax
mov ecx, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x4bf83f
mov eax, dword [ebx + 0x44]
jmp 0x4bf842
mov eax, dword [ebx + 0x40]
push 0
push 0
push 0
push 0
push 0
push eax
push ecx
mov ecx, dword [esp + 0xf0]
push ebp
push esi
call fcn.0048e450
mov eax, dword [esp + 0xd8]
test eax, eax
jne 0x4bf961
test dword [ebx + 0xc], 0x20000
jne 0x4bf961
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4bf8b6
mov edx, dword [esp + 0x54]
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x78]
push ecx
push edx
push eax
add edi, ebp
push edi
lea ecx, [esp + 0x28]
call fcn.004042a0
mov ecx, dword [esp + 0x14]
push eax
push esi
call fcn.004e6310
jmp 0x4bf961
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4bf907
mov eax, dword [ebx + 4]
test eax, eax
je 0x4bf8ca
mov eax, dword [ebx + 0x44]
jmp 0x4bf8cd
mov eax, dword [ebx + 0x40]
push 0
push 1
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x6c]
add ecx, eax
push ecx
lea ecx, [edi + ebp]
push ecx
mov ecx, dword [esp + 0xf4]
push esi
call fcn.0048e450
push 0xffffffffffffffff
push 0xffffffffffffffff
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.user32.dll_OffsetRect]
mov ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4bf922
mov eax, dword [esp + 0xe0]
test eax, eax
mov dword [esp + 0x48], 1
jne 0x4bf92a
mov dword [esp + 0x48], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x4bf936
mov eax, dword [ebx + 0x44]
jmp 0x4bf939
mov eax, dword [ebx + 0x40]
mov edx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x4c]
push 0
push 0
push edx
push 0
push eax
mov eax, dword [esp + 0x6c]
add ecx, eax
push ecx
mov ecx, dword [esp + 0xf0]
add edi, ebp
push edi
push esi
call fcn.0048e450
mov dword [esp + 0x10], 1
xor edi, edi
cmp dword [0x5a8928], edi
jne 0x4bf97f
cmp dword [esp + 0x10], edi
jne 0x4bfa4e
xor edi, edi
mov ecx, dword [ebx + 0x90]
cmp ecx, edi
jne 0x4bf9bb
call fcn.00525e10
cmp eax, edi
je 0x4bf9a9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push eax
push 0x56999c
call fcn.00526a01
add esp, 8
jmp 0x4bf9c9
xor eax, eax
push eax
push 0x56999c
call fcn.00526a01
add esp, 8
jmp 0x4bf9c9
mov eax, dword [0x5a7e88]
cmp eax, edi
jne 0x4bf9c9
call fcn.00522c58
mov edi, eax
push edi
push 0x579bf0
call fcn.00526a01
add esp, 8
test eax, eax
je 0x4bf9f0
mov edx, dword [eax]
lea ecx, [esp + 0x34]
push ecx
push ebx
push esi
mov ecx, eax
call dword [edx + 0x190]
jmp 0x4bfa4a
push edi
push 0x5797e0
call fcn.00526a01
add esp, 8
test eax, eax
je 0x4bfa15
mov edx, dword [eax]
lea ecx, [esp + 0x34]
push ecx
push ebx
push esi
mov ecx, eax
call dword [edx + 0x18c]
jmp 0x4bfa4a
push edi
push 0x579430
call fcn.00526a01
add esp, 8
test eax, eax
jne 0x4bfa39
push edi
push 0x5790d8
call fcn.00526a01
add esp, 8
test eax, eax
je 0x4bfa4e
mov edx, dword [eax]
lea ecx, [esp + 0x34]
push ecx
push ebx
mov ecx, eax
push esi
call dword [edx + 0x1a8]
mov dword [esp + 0x10], eax
xor ebp, ebp
push ebp
mov ecx, esi
call fcn.0052837b
mov edx, dword [esp + 0x3c]
mov eax, dword [ebx + 0xc]
mov ecx, dword [esp + 0x10]
inc edx
and eax, 0x10000
mov dword [esp + 0x3c], edx
je 0x4bfb4d
cmp ecx, ebp
jne 0x4bfb51
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push 0xffffffffffffffff
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x44]
push ebp
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.user32.dll_InflateRect]
cmp dword [esp + 0x2c], ebp
jne 0x4bfac6
cmp dword [esp + 0x30], ebp
je 0x4bfac6
push 0x5a79b8
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0040a420
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x94]
mov edi, dword [esp + 0x1c]
sub eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x20]
sar ecx, 1
add ecx, edi
sub eax, dword [esp + 0x90]
mov edi, dword [esp + 0x18]
sub eax, edi
cdq
sub eax, edx
mov edx, dword [esp + 0xdc]
sar eax, 1
add eax, edi
mov edi, dword [ebx + 0xac]
neg edi
mov dword [esp + 0x58], eax
push edx
sbb edi, edi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x64], ecx
and edi, 0xa
push esi
mov ecx, ebx
add edi, 2
call fcn.004b0b00
mov edx, dword [ebx + 0xc]
lea ecx, [esp + 0x50]
push ecx
shr edx, 0x12
and edx, 1
push edx
lea eax, [esp + 0x60]
push eax
push edi
push esi
mov dword [esp + 0x64], ebp
mov dword [esp + 0x68], ebp
call fcn.00490350
add esp, 0x14
jmp 0x4bfb6f
cmp ecx, ebp
je 0x4bfba5
cmp dword [esp + 0xdc], ebp
je 0x4bfb67
cmp eax, ebp
jne 0x4bfb67
call fcn.0047a8f0
push 2
jmp 0x4bfb76
cmp ecx, ebp
je 0x4bfba5
cmp eax, ebp
je 0x4bfba5
call fcn.0047a8f0
push 1
mov edi, dword [esp + 0x68]
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov edi, dword [esp + 0x7c]
mov dword [ecx + 4], edi
mov edi, dword [esp + 0x80]
mov dword [ecx + 8], edi
mov edi, dword [esp + 0x84]
push ebx
mov dword [ecx + 0xc], edi
mov ecx, eax
push esi
call dword [edx + 0x58]
cmp dword [esp + 0x10], ebp
mov dword [esp + 0x14], 0xffffffff
jne 0x4bfd15
mov eax, dword [ebx + 8]
cmp eax, 0xf060
ja 0x4bfbf1
je 0x4bfbe7
sub eax, 0xf020
je 0x4bfbdd
sub eax, 0x10
jne 0x4bfd15
mov dword [esp + 0x14], 6
jmp 0x4bfc04
mov dword [esp + 0x14], 3
jmp 0x4bfc04
mov dword [esp + 0x14], 5
jmp 0x4bfc04
cmp eax, 0xf120
jne 0x4bfd15
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call fcn.0047a8f0
mov edi, eax
call fcn.0047a8f0
mov ebp, eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x130]
mov edx, dword [ebp]
mov ecx, ebp
mov edi, eax
call dword [edx + 0x130]
neg edi
push edi
neg eax
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.user32.dll_InflateRect]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x94]
sub eax, edi
sub eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x90]
mov ecx, eax
mov eax, dword [esp + 0x20]
sar ecx, 1
add ecx, edi
mov edi, dword [esp + 0x18]
sub eax, edi
sub eax, edx
cdq
sub eax, edx
sar eax, 1
add eax, edi
mov edi, dword [esp + 0xdc]
mov dword [esp + 0x5c], ecx
push edi
lea ecx, [esp + 0x68]
push ecx
push esi
mov ecx, ebx
mov dword [esp + 0x64], eax
call fcn.004b0b00
lea edx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x48]
xor ebp, ebp
xor eax, eax
cmp edx, ebp
mov edx, dword [esp + 0x18]
setne al
lea ecx, [esp + 0x5c]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
push eax
push ecx
push edx
push esi
call fcn.00490350
add esp, 0x14
cmp edi, ebp
je 0x4bfd15
call fcn.0047a8f0
mov edi, dword [esp + 0x64]
mov edx, dword [eax]
push 2
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edi
mov edi, dword [esp + 0x7c]
mov dword [ecx + 4], edi
mov edi, dword [esp + 0x80]
mov dword [ecx + 8], edi
mov edi, dword [esp + 0x84]
push ebx
mov dword [ecx + 0xc], edi
push esi
mov ecx, eax
call dword [edx + 0x58]
mov edi, dword [esp + 0xd0]
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x80], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x84], ecx
mov ecx, dword [edx + 0xc]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
call fcn.0047a8f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x130]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0xdc]
test edx, edx
lea eax, [eax + ecx + 2]
mov dword [esp + 0x80], eax
je 0x4bfdf3
mov edx, dword [esp + 0x68]
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x24], ecx
test dword [ebx + 0xc], 0x10000
mov dword [esp + 0x1c], edx
jne 0x4bfda2
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x4bfda2
cmp dword [esp + 0x14], 0xffffffff
je 0x4bfda5
lea ebp, [eax - 1]
mov edi, dword [edi + 8]
mov eax, dword [esp + 0x44]
dec edi
test eax, eax
je 0x4bfdbd
mov edx, dword [0x5a794c]
mov dword [esp + 0x60], edx
jmp 0x4bfdc6
mov eax, dword [0x5a7970]
mov dword [esp + 0x60], eax
call fcn.0047a8f0
mov edx, dword [eax]
lea ecx, [esp + 0x60]
push ecx
sub esp, 0x10
mov ecx, esp
mov dword [ecx], ebp
mov ebp, dword [esp + 0x30]
mov dword [ecx + 4], ebp
mov dword [ecx + 8], edi
mov edi, dword [esp + 0x38]
push ebx
mov dword [ecx + 0xc], edi
push esi
mov ecx, eax
call dword [edx + 0x60]
jmp 0x4bfe10
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4bfe07
mov edx, dword [0x5a7968]
mov dword [esp + 0x60], edx
jmp 0x4bfe10
mov eax, dword [0x5a7958]
mov dword [esp + 0x60], eax
mov eax, dword [ebx + 0x10]
lea edi, [ebx + 0x10]
sub eax, 0x10
push eax
call fcn.004014c0
add eax, 0x10
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0xc4], 1
call fcn.0051fbb3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
mov byte [esp + 0xc4], 2
jle 0x4bff03
push 9
push eax
call fcn.00466cbf
add esp, 8
test eax, eax
je 0x4bff03
sub eax, dword [edi]
mov ebp, eax
js 0x4bff03
push ebp
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x18]
call fcn.00405bf0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc8], 3
call fcn.00401a70
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0xc4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bfebd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
inc ebp
push ebp
lea eax, [esp + 0x5c]
push eax
mov ecx, edi
call fcn.00410f00
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0xc8], 4
call fcn.00401a70
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0xc4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bff03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.gdi32.dll_GetTextColor]
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x50], eax
mov eax, dword [ebx + 0x20]
add ecx, 3
test eax, eax
mov dword [esp + 0x80], ecx
jne 0x4c00ca
push 0x55d628
lea ecx, [esp + 0x34]
call fcn.00401bc0
mov byte [esp + 0xc4], 5
mov edi, dword [esp + 0x10]
mov eax, dword [edi - 0xc]
test eax, eax
jle 0x4bffae
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x60]
push eax
call fcn.0053b6b8
mov ecx, dword [esp + 0x80]
mov eax, dword [eax]
add esp, 0xc
or ecx, 1
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x78], ecx
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.gdi32.dll_GetTextExtentPoint32A]
mov edx, dword [esp + 0x88]
mov ebp, dword [esp + 0x80]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
sub edx, ebp
cmp eax, edx
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x2b], 1
jg 0x4bffb3
mov byte [esp + 0x2b], 0
test byte [esp + 0x74], 1
je 0x4bffe3
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x58]
and edx, 0xfffffffe
add eax, 0xfffffff0
mov dword [esp + 0x74], edx
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bffe3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov al, byte [esp + 0x2b]
test al, al
je 0x4c0092
mov eax, dword [edi - 0xc]
dec eax
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.00405bf0
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
mov byte [esp + 0xc4], 6
je 0x4c0063
mov edx, dword [edi + 0xc]
test edx, edx
lea ebp, [edi + 0xc]
jl 0x4c0055
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4c0055
push eax
call fcn.004014c0
mov dword [esp + 0x4c], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebp], eax
dec eax
test eax, eax
jg 0x4c0048
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [esp + 0x48]
add eax, 0x10
mov dword [esp + 0x10], eax
jmp 0x4c0063
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.004017a0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xc4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4bff43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x4bff43
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.00401840
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xc4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c00ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x44]
test eax, eax
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
je 0x4c014d
mov eax, dword [esp + 0xdc]
test eax, eax
jne 0x4c014d
call fcn.0047a8f0
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4c014d
mov ecx, dword [0x5a7954]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x88]
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x90]
push 1
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.user32.dll_OffsetRect]
mov eax, dword [edi - 0xc]
mov edx, dword [esi]
push 0x24
lea ecx, [esp + 0x1c]
push ecx
push eax
push edi
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esp + 0x60]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [edi - 0xc]
mov edx, dword [esi]
push 0x24
lea ecx, [esp + 0x84]
push ecx
push eax
push edi
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4c025a
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov edx, 0xfffffffd
sub edx, edi
add eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x44]
test eax, eax
mov dword [esp + 0x24], ecx
je 0x4c023b
mov eax, dword [esp + 0xdc]
test eax, eax
jne 0x4c023b
call fcn.0047a8f0
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4c023b
mov ecx, dword [0x5a7954]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
push 1
mov dword [esp + 0x98], eax
mov dword [esp + 0x94], edx
mov edx, dword [esp + 0x28]
push 1
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa8], edx
call dword [sym.imp.user32.dll_OffsetRect]
mov eax, dword [ebp - 0xc]
mov edx, dword [esi]
push 0x26
lea ecx, [esp + 0x94]
push ecx
push eax
push ebp
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esp + 0x60]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [ebp - 0xc]
mov edx, dword [esi]
push 0x26
lea ecx, [esp + 0x1c]
push ecx
push eax
push ebp
mov ecx, esi
call dword [edx + 0x68]
cmp dword [ebx + 8], 0xffffffff
je 0x4c0278
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0x4c0278
mov eax, dword [ebx + 0xa4]
test eax, eax
je 0x4c032c
mov edx, dword [esi]
push 0x5a7a6c
mov ecx, esi
call dword [edx + 0x28]
mov edi, eax
mov eax, dword [esp + 0xd0]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x90], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x94], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x98], ecx
push 0x5770e8
lea ecx, [esp + 0x18]
mov dword [esp + 0xa0], edx
call fcn.00401bc0
mov eax, dword [ebx + 0xbc]
test eax, eax
mov byte [esp + 0xc4], 7
je 0x4c02e4
push 1
push 0x5770e4
lea ecx, [esp + 0x1c]
call fcn.004017a0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
mov edx, dword [esi]
push 0x26
lea ebx, [esp + 0x94]
push ebx
push ecx
push eax
mov ecx, esi
call dword [edx + 0x68]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x28]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xc4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c032c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x4c033f
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x28]
mov ecx, dword [esp + 0x50]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x30]
mov ecx, dword [esp + 0xa4]
test ecx, ecx
je 0x4c0363
lea edx, [esp + 0xb0]
push edx
call fcn.0048d920
lea eax, [ebp - 0x10]
mov byte [esp + 0xc4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c0385
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0xc4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4c03ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0xa8]
mov dword [esp + 0xc4], 0xffffffff
mov dword [esp + 0xa8], vtable.CGdiObject.0
call fcn.00528977
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xb8
ret 0x18