Function at 0x4b6a1c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff1c
mov dword [esp], edx
mov edi, eax
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
mov esi, dword [eax + 0xc]
cmp edi, 0x8a
jl 0x4b6a49
cmp edi, 0x8c
jle 0x4b6a5f
cmp edi, 0xac
je 0x4b6a5f
cmp edi, 0x64
je 0x4b6a5f
cmp edi, 0x65
je 0x4b6a5f
xor eax, eax
jmp 0x4b6a61
mov al, 1
mov byte [esp + 0x59], al
cmp edi, 0x8a
sete byte [esp + 0x5a]
cmp edi, 0xac
sete byte [esp + 0x5b]
cmp edi, 0x64
je 0x4b6a89
cmp edi, 0x65
je 0x4b6a89
xor eax, eax
jmp 0x4b6a8b
mov al, 1
mov byte [esp + 0x5c], al
mov ebx, dword [0x4be784]
mov bl, byte [ebx + 0x187f]
cmp byte [esp + 0x59], 0
je 0x4b6aa4
xor ebx, ebx
mov ebp, dword [esp + 4]
mov eax, dword [0x4be684]
cmp byte [eax], 0
je 0x4b6add
cmp esi, 1
jne 0x4b6add
push 0xffffffffffffffeb
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x14]
push eax
call sub.user32.dll_GetWindowLongA
mov edx, dword [0x4be8d0]
mov byte [edx], al
mov eax, dword [0x4be8d0]
cmp byte [eax], 1
jne 0x4b6add
mov esi, 7
push 5
call sub.gdi32.dll_GetStockObject
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
push eax
call sub.user32.dll_GetParent
mov dword [esp + 0x30], eax
push 0x64
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x38]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x4bebc4]
cmp word [eax], 0x27
jne 0x4b6b3d
cmp edi, 4
jl 0x4b6b3d
cmp edi, 7
jg 0x4b6b3d
mov ax, 0x2c2
call fcn.004aa600
push eax
lea eax, [esp + 0x64]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x4b6b41
xor eax, eax
jmp 0x4b6b43
mov al, 1
mov byte [esp + 0x58], al
mov eax, dword [ebp + 0x14]
push eax
call sub.user32.dll_IsWindowEnabled
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 0x2b], al
mov eax, dword [ebp + 0x10]
test al, 1
setne byte [esp + 0x28]
test al, 0x10
setne byte [esp + 0x29]
push 0xffffffffffffffeb
mov eax, dword [ebp + 0x14]
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0x80000001
jns 0x4b6b82
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x4b6b90
call sub.user32.dll_GetActiveWindow
cmp eax, dword [esp + 0x30]
je 0x4b6b94
xor eax, eax
jmp 0x4b6b96
mov al, 1
mov byte [esp + 0x2a], al
cmp byte [esp + 0x59], 0
je 0x4b6bab
mov byte [esp + 0x29], 0
mov byte [esp + 0x2a], 0
test esi, 2
je 0x4b6bd2
cmp byte [esp + 0x28], 0
jne 0x4b6bd2
movsx eax, word [0x4d0290]
cmp edi, eax
jne 0x4b6bd2
mov eax, dword [ebp + 0x14]
call fcn.004b68ac
mov byte [esp + 0x2a], 1
test esi, 4
je 0x4b6cba
cmp byte [esp + 0x29], 0
je 0x4b6c69
cmp byte [esp + 0x2a], 0
jne 0x4b6cba
lea eax, [esp + 0x3c]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [esp + 0xc5]
push eax
mov eax, dword [ebp + 0x14]
push eax
call sub.user32.dll_GetWindowRect
mov eax, dword [esp + 0xd1]
push eax
mov eax, dword [esp + 0xd1]
push eax
mov eax, dword [esp + 0xd1]
push eax
mov eax, dword [esp + 0xd1]
push eax
call sub.gdi32.dll_CreateRectRgn
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x4c]
push eax
call sub.gdi32.dll_PtInRegion
test eax, eax
je 0x4b6c5a
mov eax, dword [0x4beed8]
mov word [eax], di
jmp 0x4b6cba
mov eax, dword [ebp + 0x14]
call fcn.004b68ac
mov byte [esp + 0x2a], 1
jmp 0x4b6cba
call sub.user32.dll_GetFocus
lea edx, [esp + 0x4c]
call fcn.004b6718
test al, al
jne 0x4b6cba
mov eax, dword [esp + 0x30]
call fcn.004b6840
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 0
jbe 0x4b6ca8
mov eax, dword [esp + 0x34]
call fcn.004b68ac
push 0
push 0
mov eax, dword [esp + 0x3c]
push eax
call sub.user32.dll_InvalidateRect
jmp 0x4b6cb5
push 0
push 0xffffffffffffffeb
mov eax, dword [ebp + 0x14]
push eax
call sub.user32.dll_SetWindowLongA
mov byte [esp + 0x2a], 0
push 7
call sub.gdi32.dll_GetStockObject
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov dword [esp + 0xc], eax
cmp byte [esp + 0x2a], 0
je 0x4b6d36
mov eax, dword [0x4bee78]
mov eax, dword [eax]
push eax
push 0
push 0
call sub.gdi32.dll_CreatePen
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp + 0x28]
push eax
mov eax, dword [ebp + 0x24]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_Rectangle
inc dword [ebp + 0x1c]
inc dword [ebp + 0x20]
dec dword [ebp + 0x24]
dec dword [ebp + 0x28]
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [esp + 8]
push eax
call sub.gdi32.dll_DeleteObject
cmp byte [esp + 0x5c], 0
je 0x4b6d57
mov eax, dword [0x4be7e8]
mov eax, dword [eax]
push eax
lea eax, [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_FillRect
jmp 0x4b7344
test bl, bl
jne 0x4b6dbe
mov eax, 0x10
cmp byte [esp + 0x28], 0
je 0x4b6d6c
or eax, 0x200
push eax
push 4
lea eax, [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_DrawFrameControl
push edi
lea esi, [ebp + 0x1c]
lea edi, [esp + 0xc9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push 0xfffffffffffffffd
push 0xfffffffffffffffd
lea eax, [esp + 0xcd]
push eax
call sub.user32.dll_InflateRect
cmp byte [esp + 0x29], 0
je 0x4b7344
lea eax, [esp + 0xc5]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_DrawFocusRect
jmp 0x4b7344
cmp bl, 5
jl 0x4b6dcd
mov dword [esp + 0x48], 0x14
jmp 0x4b6dd5
mov dword [esp + 0x48], 0xc
cmp bl, 3
jl 0x4b6f68
mov eax, dword [0x4be378]
cmp byte [eax], 0
jne 0x4b6f68
mov eax, dword [esp + 0x48]
add eax, eax
mov dword [esp + 0xd8], eax
xor eax, eax
mov dword [esp + 0xdc], eax
fild qword [esp + 0xd8]
fild dword [ebp + 0x28]
fdivp st(1)
fstp qword [esp + 0x20]
wait
mov si, word [ebp + 0x20]
add si, 2
mov ax, word [ebp + 0x28]
sub ax, 3
sub ax, si
jl 0x4b6f7d
inc eax
mov word [esp + 0x5e], ax
mov eax, dword [0x4be678]
mov eax, dword [eax]
call fcn.0040672c
and eax, 0xff
add eax, dword [esp + 0x48]
push eax
mov word [esp + 0xe4], si
fild word [esp + 0xe4]
fmul qword [esp + 0x24]
call fcn.004028e8
pop edx
sub edx, eax
mov eax, 0xff
call fcn.004aa570
mov byte [esp + 0x2c], al
mov eax, dword [0x4be678]
mov eax, dword [eax]
call fcn.00406730
and eax, 0xff
add eax, dword [esp + 0x48]
push eax
mov word [esp + 0xe4], si
fild word [esp + 0xe4]
fmul qword [esp + 0x24]
call fcn.004028e8
pop edx
sub edx, eax
mov eax, 0xff
call fcn.004aa570
mov byte [esp + 0x2d], al
mov eax, dword [0x4be678]
mov eax, dword [eax]
call fcn.00406734
and eax, 0xff
add eax, dword [esp + 0x48]
push eax
mov word [esp + 0xe4], si
fild word [esp + 0xe4]
fmul qword [esp + 0x24]
call fcn.004028e8
pop edx
sub edx, eax
mov eax, 0xff
call fcn.004aa570
mov byte [esp + 0x2e], al
mov cl, byte [esp + 0x2e]
mov dl, byte [esp + 0x2d]
mov al, byte [esp + 0x2c]
call fcn.00406710
push eax
push 0
push 0
call sub.gdi32.dll_CreatePen
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov dx, word [ebp + 0x1c]
add dx, 2
mov ecx, esi
mov eax, dword [ebp + 0x18]
call fcn.004addb4
movsx eax, si
push eax
mov eax, dword [ebp + 0x24]
sub eax, 2
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_LineTo
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [esp + 8]
push eax
call sub.gdi32.dll_DeleteObject
inc esi
dec word [esp + 0x5e]
jne 0x4b6e32
jmp 0x4b6f7d
mov eax, dword [0x4be7e8]
mov eax, dword [eax]
push eax
lea eax, [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_FillRect
lea esi, [ebp + 0x1c]
cmp byte [esp + 0x28], 0
jne 0x4b7035
mov ax, word [esi]
push eax
mov eax, dword [0x4be494]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 0xc]
dec ecx
mov dx, word [esi + 4]
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 8]
dec eax
push eax
mov eax, dword [0x4be5ec]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 4]
inc ecx
mov dx, word [esi + 0xc]
dec edx
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 4]
push eax
mov eax, dword [0x4be494]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 8]
dec ecx
mov dx, word [esi]
inc edx
mov eax, dword [ebp + 0x18]
call fcn.004b6128
mov ax, word [esi + 0xc]
dec eax
push eax
mov eax, dword [0x4be5ec]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi]
inc ecx
mov dx, word [esi + 8]
sub dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6128
jmp 0x4b70da
mov ax, word [esi]
push eax
mov eax, dword [0x4be5ec]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 0xc]
dec ecx
mov dx, word [esi + 4]
dec edx
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 8]
dec eax
push eax
mov eax, dword [0x4be494]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 4]
inc ecx
mov dx, word [esi + 0xc]
dec edx
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 4]
push eax
mov eax, dword [0x4be5ec]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 8]
dec ecx
mov dx, word [esi]
mov eax, dword [ebp + 0x18]
call fcn.004b6128
mov ax, word [esi + 0xc]
dec eax
push eax
mov eax, dword [0x4be494]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi]
inc ecx
mov dx, word [esi + 8]
sub dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6128
cmp bl, 2
je 0x4b70ed
cmp bl, 4
je 0x4b70ed
cmp bl, 6
jne 0x4b71bd
cmp byte [esp + 0x28], 0
jne 0x4b71bd
mov ax, word [esi]
inc eax
push eax
mov eax, dword [0x4bee98]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 0xc]
sub cx, 3
mov dx, word [esi + 4]
inc edx
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 8]
sub ax, 2
push eax
mov eax, dword [0x4bebb0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 4]
add cx, 2
mov dx, word [esi + 0xc]
sub dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 4]
inc eax
push eax
mov eax, dword [0x4bee98]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 8]
sub cx, 3
mov dx, word [esi]
add dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6128
mov ax, word [esi + 0xc]
sub ax, 2
push eax
mov eax, dword [0x4bebb0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi]
add cx, 2
mov dx, word [esi + 8]
sub dx, 3
mov eax, dword [ebp + 0x18]
call fcn.004b6128
jmp 0x4b7344
cmp bl, 6
je 0x4b7284
mov ax, word [esi]
inc eax
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 0xc]
sub cx, 3
mov dx, word [esi + 4]
inc edx
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 8]
sub ax, 2
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov dx, word [esi + 0xc]
sub dx, 2
mov cx, word [esi + 4]
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 4]
inc eax
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 8]
sub cx, 2
mov dx, word [esi]
add dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6128
mov ax, word [esi + 0xc]
sub ax, 2
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi]
inc ecx
mov dx, word [esi + 8]
sub dx, 3
mov eax, dword [ebp + 0x18]
call fcn.004b6128
jmp 0x4b7344
mov ax, word [esi]
inc eax
push eax
mov eax, dword [0x4bebb0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 0xc]
sub cx, 3
mov dx, word [esi + 4]
inc edx
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 8]
sub ax, 2
push eax
mov eax, dword [0x4bee98]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 4]
add cx, 2
mov dx, word [esi + 0xc]
sub dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6290
mov ax, word [esi + 4]
inc eax
push eax
mov eax, dword [0x4bebb0]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi + 8]
sub cx, 3
mov dx, word [esi]
add dx, 2
mov eax, dword [ebp + 0x18]
call fcn.004b6128
mov ax, word [esi + 0xc]
sub ax, 2
push eax
mov eax, dword [0x4bee98]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be678]
mov eax, dword [eax]
push eax
push 0x46
mov cx, word [esi]
add cx, 2
mov dx, word [esi + 8]
sub dx, 3
mov eax, dword [ebp + 0x18]
call fcn.004b6128
cmp byte [esp + 0x59], 0
jne 0x4b735d
push 0x64
lea eax, [esp + 0x64]
push eax
mov eax, dword [ebp + 0x14]
push eax
call sub.user32.dll_GetWindowTextA
jmp 0x4b739c
cmp byte [esp + 0x5a], 0
je 0x4b7378
mov ax, 0x2ce
call fcn.004aa600
mov edx, eax
lea eax, [esp + 0x60]
call fcn.004b81b0
cmp byte [esp + 0x5c], 0
je 0x4b739c
cmp edi, 0x65
sete al
and eax, 0x7f
add ax, 0x377
call fcn.004aa600
mov edx, eax
lea eax, [esp + 0x60]
call fcn.004b81b0
cmp byte [esp + 0x28], 0
je 0x4b73b0
push 1
push 1
lea eax, [ebp + 0x1c]
push eax
call sub.user32.dll_OffsetRect
push 1
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SetBkMode
xor esi, esi
test bl, bl
cmp byte [esp + 0x59], 0
je 0x4b757b
mov eax, dword [0x4be8b8]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov esi, eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [esp + 0x14], eax
mov eax, dword [0x4be4c0]
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov dword [esp + 0x18], eax
cmp byte [esp + 0x5a], 0
je 0x4b743f
push 0xcc0020
push 0
push 0x180
mov eax, dword [esp + 0x20]
push eax
push 0xf
push 0x10
xor eax, eax
mov al, byte [esp + 0x40]
add eax, 2
push eax
xor eax, eax
mov al, byte [esp + 0x44]
add eax, 0x34
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_BitBlt
jmp 0x4b7545
cmp byte [esp + 0x5b], 0
je 0x4b7505
push 0
push 0xac
mov eax, dword [0x4be75c]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetMenuState
cmp eax, 8
sete al
and eax, 0x7f
add eax, 0x22
mov edx, dword [0x4be6b0]
mov dword [edx], eax
push 0xcc0020
push 0
mov eax, dword [0x4be6b0]
mov eax, dword [eax]
shl eax, 4
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xf
push 0x10
xor eax, eax
mov al, byte [esp + 0x40]
add eax, 2
push eax
xor eax, eax
mov al, byte [esp + 0x44]
add eax, 4
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [0x4befb8]
cmp dword [eax], 0
jne 0x4b74d4
push 0x1020
push 0x10
push 0x10
push 1
push 0xe
mov eax, dword [0x4bf704]
push eax
call sub.user32.dll_LoadImageA
mov edx, dword [0x4befb8]
mov dword [edx], eax
push 2
push 0
push 0
push 0x10
push 0x10
mov eax, dword [0x4befb8]
mov eax, dword [eax]
push eax
xor eax, eax
mov al, byte [esp + 0x40]
add eax, 2
push eax
xor eax, eax
mov al, byte [esp + 0x44]
add eax, 0x16
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_DrawIconEx
jmp 0x4b7545
cmp byte [esp + 0x5c], 0
jne 0x4b7545
push 0xcc0020
push 0
lea eax, [edi + 0x19]
sub eax, 0x8b
shl eax, 4
push eax
mov eax, dword [esp + 0x20]
push eax
push 0xf
push 0x10
xor eax, eax
mov al, byte [esp + 0x40]
add eax, 2
push eax
xor eax, eax
mov al, byte [esp + 0x44]
add eax, 2
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [esp + 0x14]
push eax
call sub.gdi32.dll_DeleteDC
cmp byte [esp + 0x5c], 0
jne 0x4b7574
push 0
push 0xfffffffffffffff7
lea eax, [ebp + 0x1c]
push eax
call sub.user32.dll_OffsetRect
jmp 0x4b757b
mov dword [ebp + 0x1c], 5
cmp byte [esp + 0x58], 0
je 0x4b762a
lea edx, [esp + 0x60]
mov eax, dword [0x4bedb0]
call fcn.004b81b0
mov eax, dword [0x4bedb0]
mov dl, 0x26
call fcn.004aec2c
lea eax, [esp + 0x50]
push eax
mov eax, dword [0x4bedb0]
call fcn.004b8144
push eax
mov eax, dword [0x4bedb0]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_GetTextExtentPoint32A
test eax, eax
je 0x4b75fc
mov eax, dword [ebp + 0x24]
sub eax, dword [ebp + 0x1c]
mov edx, dword [esp + 0x50]
add edx, 0x18
sub eax, edx
mov edx, dword [0x4be6b0]
mov dword [edx], eax
mov eax, dword [0x4be6b0]
mov eax, dword [eax]
sar eax, 1
jns 0x4b75e8
adc eax, 0
sub dword [ebp + 0x24], eax
mov eax, dword [0x4be6b0]
mov eax, dword [eax]
sar eax, 1
jns 0x4b75f9
adc eax, 0
add dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x28]
sub eax, dword [ebp + 0x20]
sub eax, 0xf
sar eax, 1
jns 0x4b760c
adc eax, 0
add eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
mov edx, edi
mov eax, dword [ebp + 0x18]
call fcn.004b6914
push 0
push 0xa
lea eax, [ebp + 0x1c]
push eax
call sub.user32.dll_OffsetRect
test bl, bl
jle 0x4b76b4
cmp byte [esp + 0x2b], 0
je 0x4b7640
cmp byte [esp + 0x29], 0
je 0x4b7689
mov eax, dword [0x4be494]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SetTextColor
push 1
push 1
lea eax, [ebp + 0x1c]
push eax
call sub.user32.dll_OffsetRect
push 0x25
lea eax, [ebp + 0x1c]
push eax
lea eax, [esp + 0x68]
call fcn.004b8144
push eax
lea eax, [esp + 0x6c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_DrawTextA
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp + 0x1c]
push eax
call sub.user32.dll_OffsetRect
cmp byte [esp + 0x2b], 0
jne 0x4b76a3
mov eax, dword [0x4bebb0]
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SetTextColor
jmp 0x4b76b4
push 0x12
call sub.user32.dll_GetSysColor
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SetTextColor
cmp byte [esp + 0x5a], 0
jne 0x4b76c2
cmp byte [esp + 0x59], 0
jne 0x4b76e0
push 0x25
lea eax, [ebp + 0x1c]
push eax
lea eax, [esp + 0x68]
call fcn.004b8144
push eax
lea eax, [esp + 0x6c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_DrawTextA
cmp byte [esp + 0x5c], 0
je 0x4b7705
push 0x24
lea eax, [ebp + 0x1c]
push eax
lea eax, [esp + 0x68]
call fcn.004b8144
push eax
lea eax, [esp + 0x6c]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.user32.dll_DrawTextA
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
test esi, esi
je 0x4b7721
push esi
mov eax, dword [ebp + 0x18]
push eax
call sub.gdi32.dll_SelectObject
add esp, 0xe4
pop ebp
pop edi
pop esi
pop ebx
ret