Function at 0x481b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x59e610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
push edi
mov edi, ecx
mov ecx, 0x618780
call fcn.0057aa7a
mov dword [esp + 0xc], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
lea ecx, [edx + eax + 4]
lea edx, [esp + 0x50]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
sub esp, 8
fld qword [esi + 0x18]
fadd qword [0x5af430]
fstp qword [esp]
call fcn.0053e2af
add esp, 8
call fcn.0053e380
fld qword [esi + 0x10]
fadd qword [0x5af430]
push eax
sub esp, 8
fstp qword [esp]
call fcn.0053e2af
add esp, 8
call fcn.0053e380
fld qword [esi + 8]
fadd qword [0x5af430]
push eax
sub esp, 8
fstp qword [esp]
call fcn.0053e2af
add esp, 8
call fcn.0053e380
fld qword [esi]
fadd qword [0x5af430]
push eax
sub esp, 8
fstp qword [esp]
call fcn.0053e2af
add esp, 8
call fcn.0053e380
push eax
lea ecx, [esp + 0x30]
call fcn.0043ea10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov edx, dword [0x618788]
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
push 2
push ecx
push edx
mov dword [esp + 0x48], eax
call dword [sym.imp.GDI32.dll_LPtoDP]
push 1
mov ecx, 0x618780
call fcn.0057ad8b
push 0
lea eax, [esp + 0x24]
push 0
push eax
mov ecx, 0x618780
call fcn.0057adb9
push 0
lea ecx, [esp + 0x24]
push 0
push ecx
mov ecx, 0x618780
call fcn.0057aef5
push 1
push 1
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.USER32.dll_InflateRect]
lea esi, [edi + 0x24]
test esi, esi
jne 0x481cc5
xor eax, eax
jmp 0x481cc8
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_WindowFromDC]
test eax, eax
je 0x481e69
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], vtable.CBrush.0
test esi, esi
mov dword [esp + 0x78], 0
je 0x481d02
mov esi, dword [esi + 4]
push 0x26
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
shr eax, 8
and al, 1
neg al
sbb eax, eax
and eax, 0xffdfdfe0
add eax, 0xe0e0e0
push eax
push 5
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push eax
lea ecx, [esp + 0x1c]
call fcn.0057bc57
push 2
mov ecx, 0x618780
call fcn.0057aca4
push 0xffffff
mov ecx, 0x618780
call fcn.0057ac75
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x48]
cmp edx, eax
mov edi, vtable.CGdiObject.0
jg 0x481e2c
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
cmp eax, ecx
jl 0x481e2c
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x4c]
cmp ecx, eax
jg 0x481e2c
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x44]
cmp edx, eax
jl 0x481e2c
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x481e4c
mov eax, dword [esi + 4]
test eax, eax
je 0x481e4c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.CRgn.0
lea eax, [esp + 0x40]
mov byte [esp + 0x78], 1
push eax
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
push eax
lea ecx, [esp + 0x14]
call fcn.0057bc57
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x10]
push 4
neg eax
sbb eax, eax
push ecx
and eax, edx
push eax
push edx
call dword [sym.imp.GDI32.dll_CombineRgn]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
mov edx, dword [esp + 0x14]
sbb eax, eax
and eax, ecx
lea ecx, [esp + 0x10]
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
mov ecx, dword [0x618784]
push ecx
call dword [sym.imp.GDI32.dll_FillRgn]
mov dword [esp + 0x10], edi
lea ecx, [esp + 0x10]
mov byte [esp + 0x78], 2
call fcn.0057bcae
jmp 0x481e4c
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
neg eax
sbb eax, eax
and eax, edx
lea edx, [esp + 0x40]
push eax
mov eax, dword [0x618784]
push edx
push eax
call dword [sym.imp.USER32.dll_FillRect]
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x78], 3
call fcn.0057bcae
mov dword [esp + 0x78], 0xffffffff
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, 0x618780
call fcn.0057aaab
mov ecx, dword [esp + 0x70]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8