Function at 0x4481f0
Capabilities:
Check for foreground window switch
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4790e8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1374
call fcn.0041a230
mov eax, dword [0x4951c0]
xor eax, esp
mov dword [esp + 0x1370], eax
push ebx
push esi
push edi
mov eax, dword [0x4951c0]
xor eax, esp
push eax
lea eax, [esp + 0x1388]
mov dword fs:[0], eax
xor edi, edi
mov esi, ecx
mov dword [esp + 0x18], esi
cmp dword [0x58fb70], edi
je 0x44824c
mov byte [esp + 0x17], 1
jmp 0x448254
cmp dword [0x58fb74], edi
je 0x44828b
mov eax, dword [0x54c0d4]
cmp eax, 0xffffffff
jne 0x44827b
mov eax, dword [0x4edb8c]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xc0], eax
mov eax, dword [0x4ed660]
cdq
sub eax, edx
sar eax, 1
jmp 0x448287
mov dword [esp + 0xc0], eax
mov eax, dword [0x54acf0]
mov dword [esp + 0x64], eax
xor eax, eax
mov dword [esp + 0xb8], edi
lea edx, [eax + 1]
cmp dword [0x58fe34], edi
je 0x448320
mov byte [esp + 0x8b4], 0x40
jmp 0x4482b0
mov cl, byte [eax + 0x53a0c8]
mov byte [esp + eax + 0x8b5], cl
add eax, edx
test cl, cl
jne 0x4482b0
mov dword [esp + 0xb8], 0xfffffc7c
mov dword [0x58fb7c], edx
mov dword [esp + 0x1390], edi
cmp dword [0x591610], edx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x20], edi
jge 0x448349
cmp byte [0x4ed770], 0
je 0x44833c
push edi
push 0x4ed770
cmp dword [0x653778], edi
je 0x448335
mov ecx, 0xa
call fcn.004700b0
mov dword [0x58fb7c], edi
xor eax, eax
jmp 0x44b152
mov cl, byte [eax + 0x53a0c8]
mov byte [esp + eax + 0x8b4], cl
add eax, edx
test cl, cl
jne 0x448320
jmp 0x4482ce
mov ecx, esi
call fcn.00471890
mov dword [0x58fb7c], edi
xor eax, eax
jmp 0x44b152
mov dword [esp + 0x24], edx
mov dword [esp + 0x8c], edx
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x448384
mov ecx, dword [0x59262c]
mov byte [ecx + 0x59162c], 0
xor eax, eax
jmp 0x448370
mov cl, byte [eax + 0x59162c]
mov byte [esp + eax + 0x9b4], cl
inc eax
test cl, cl
jne 0x448370
jmp 0x4483bc
mov eax, dword [0x591610]
mov ecx, dword [0x591608]
sub eax, esi
xor edx, edx
test eax, eax
jle 0x4483a3
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x4483bc
inc edx
cmp edx, eax
jl 0x448397
test ecx, ecx
je 0x4483bc
mov edx, dword [ecx]
mov ecx, dword [edx]
lea edx, [esp + 0x9b4]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4483b2
mov edi, dword [0x58fb74]
test edi, edi
je 0x44840b
lea eax, [esp + 0x9b4]
mov byte [esp + 0x17], 0
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4483d7
sub eax, esi
je 0x44840b
cmp byte [esp + edx + 0x9b4], 0x28
je 0x448406
lea eax, [esp + 0x9b4]
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4483f7
sub eax, esi
cmp edx, eax
jb 0x4483e2
jmp 0x44840b
mov byte [esp + 0x17], 1
mov eax, dword [0x4965ec]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, eax
add eax, eax
cmp dword [0x58fe34], 0
mov dword [esp + 0xb4], eax
je 0x44847d
mov eax, dword [0x4ed870]
mov ecx, dword [0x4ab6cc]
mov edx, dword [0x4ed550]
dec eax
imul eax, ecx
add eax, dword [0x4ebfc8]
cmp byte [esp + 0x17], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
je 0x4484b3
mov edx, dword [0x4edb8c]
sub edx, ecx
add eax, edx
mov dword [esp + 0x1c], eax
jmp 0x4484b3
cmp byte [esp + 0x17], 0
mov eax, dword [0x4ebfc8]
mov ecx, dword [0x4ed550]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
je 0x4484b3
mov edx, dword [0x4edb80]
sub edx, dword [0x4ed660]
add dword [esp + 0x10], edx
test edi, edi
je 0x4484b3
mov eax, dword [esp + 0x64]
add dword [esp + 0x10], eax
mov esi, dword [0x53b594]
mov edi, dword [0x544434]
mov ebx, dword [0x4edba0]
mov edx, dword [0x53c458]
mov dword [esp + 0x90], edi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x98], esi
mov dword [esp + 0x84], edx
test esi, esi
jge 0x4484f4
xor esi, esi
mov dword [esp + 0x98], esi
test edx, edx
jge 0x448501
xor edx, edx
mov dword [esp + 0x84], edx
mov ecx, dword [0x4965ec]
dec ecx
cmp esi, ecx
jle 0x448515
mov esi, ecx
mov dword [esp + 0x98], esi
mov eax, dword [0x4967f0]
dec eax
cmp edx, eax
jle 0x448526
mov dword [esp + 0x84], eax
test edi, edi
jge 0x448533
xor edi, edi
mov dword [esp + 0x90], edi
test ebx, ebx
jge 0x448540
xor ebx, ebx
mov dword [esp + 0x80], ebx
cmp edi, ecx
jle 0x44854d
mov edi, ecx
mov dword [esp + 0x90], edi
cmp ebx, eax
jle 0x44855a
mov ebx, eax
mov dword [esp + 0x80], ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x10]
push eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x44], eax
cmp dword [esp + 0x8c], 0
mov byte [esp + 0x1390], 1
je 0x4485f6
cmp dword [0x53b590], 1
jne 0x4485f6
cmp dword [0x496800], 0
je 0x4485f6
mov edx, dword [0x53c458]
mov ebx, dword [0x4edba0]
mov ecx, dword [0x544434]
xor eax, eax
push edx
mov edx, dword [0x53b594]
mov dword [0x49b484], eax
mov dword [0x53b590], eax
call fcn.0044e920
add esp, 4
mov eax, 0x53b798
call fcn.004566d0
mov eax, dword [0x4ed874]
mov ecx, dword [0x52dc0c]
push 0x53b798
push eax
push ecx
mov ecx, dword [esp + 0x24]
mov edx, 0x544438
call fcn.0045f070
mov ebx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
add edx, 2
add esi, 2
xor eax, eax
mov dword [esp + 0xcc], edi
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], edx
mov dword [0x49b484], 1
call fcn.004566d0
cmp dword [esp + 0x8c], 0
lea eax, [esp + 0xcc]
push eax
je 0x44866b
mov ecx, dword [0x4ed874]
mov edx, dword [0x52dc0c]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, 0x544438
call fcn.0045f070
mov dword [esp + 0x8c], 0
jmp 0x44867a
mov ecx, dword [esp + 0x1c]
push 0
push 1
xor edx, edx
call fcn.0045f070
mov esi, dword [0x543990]
mov eax, dword [0x497dc4]
neg esi
sbb esi, esi
cdq
idiv dword [0x497de4]
and esi, 0x2bc
cmp dword [0x497dd8], 1
jne 0x4486a4
cdq
sub eax, edx
sar eax, 1
mov edx, dword [0x4edb8c]
mov ecx, dword [0x4ed660]
lea edi, [edx + edx*2]
cmp eax, edi
jl 0x4486c6
lea eax, [ecx + ecx*2]
cmp dword [0x497dc8], eax
jge 0x448782
mov eax, dword [0x497d78]
lea ebx, [ecx + ecx*2]
test eax, eax
je 0x448719
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [0x497db4], 0
je 0x448708
mov ecx, dword [0x497dc0]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [0x497db4]
push edx
call fcn.00407f4f
add esp, 4
mov dword [0x497db4], 0
xor eax, eax
mov dword [0x497d78], eax
mov dword [0x497dd4], eax
mov byte [0x497b60], al
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [0x497d78], eax
mov eax, ebx
mov ecx, edi
mov ebx, 0x497d7c
call fcn.00469800
mov eax, dword [0x497dc0]
mov ecx, dword [0x497d78]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [0x497d78]
push 0xffffff
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x497d78]
push 2
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [0x497d78]
push 0
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edx, dword [0x4edb8c]
mov ecx, dword [0x4ed660]
lea eax, [esp + 0x8b4]
push eax
mov eax, dword [esp + 0xbc]
push 1
xor edi, edi
push edi
push edi
push edi
push 0x80
push edi
push edi
push edi
push esi
push eax
push eax
lea eax, [edx + edx*2]
cdq
sub eax, edx
sar eax, 1
push eax
lea ecx, [ecx + ecx*2]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edx, dword [0x497d78]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ax, word [0x485b5c]
mov cl, byte [0x485b5e]
mov word [esp + 0x40], ax
mov eax, dword [0x4ab594]
shl eax, 8
add eax, 0x49b588
mov dword [esp + 0x34], eax
mov eax, dword [0x4ab5a8]
shl eax, 8
add eax, 0x49b588
mov dword [esp + 0x70], eax
mov eax, dword [0x544f30]
shl eax, 8
add eax, 0x49b588
mov dword [esp + 0x2c], edi
mov byte [esp + 0x42], cl
mov dword [esp + 0xbc], eax
mov dword [esp + 0x88], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x30], edi
cmp dword [0x58fe00], 0
jne 0x448879
lea edx, [esp + 0xc4]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
lea eax, [esp + 0xc4]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0xc8]
mov edx, dword [esi + 0x10]
shl eax, 0x10
add eax, dword [esp + 0xc4]
push eax
push 0
push 0x200
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x2c]
mov cl, byte [esp + eax + 0x9b4]
movzx eax, cl
mov byte [esp + 0x63], cl
cmp eax, 0x5c
ja case.0x44889b.1
movzx edx, byte [eax + 0x44b190]
jmp dword [edx*4 + 0x44b178]
cmp dword [0x58fb94], 0
jne case.0x44889b.1
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x88], edx
inc edx
mov al, 0x2f
mov dword [esp + 0x9c], edi
mov dword [esp + 0x94], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x78], 1
mov ecx, edx
cmp byte [esp + edx + 0x9b4], al
je 0x4488fa
lea ebx, [ebx]
inc ecx
cmp byte [esp + ecx + 0x9b4], al
jne 0x4488f0
mov eax, ecx
sub eax, edx
cdq
sub eax, edx
mov esi, eax
inc ecx
mov al, 0x29
sar esi, 1
mov edx, ecx
cmp byte [esp + ecx + 0x9b4], al
je 0x44891d
inc ecx
cmp byte [esp + ecx + 0x9b4], al
jne 0x448913
mov eax, ecx
sub eax, edx
cdq
sub eax, edx
sar eax, 1
cmp dword [0x58fe34], 0
jne 0x448a4f
mov ecx, dword [0x4ab6cc]
imul eax, dword [esp + 0xc0]
mov edx, esi
imul edx, ecx
cmp eax, edx
mov edx, dword [0x4ed870]
jle 0x4489d7
imul edx, ecx
add edx, dword [0x4ebfc8]
add ecx, eax
add ecx, edi
cmp ecx, edx
jl 0x4489ba
mov dl, byte [esp + 0x17]
test dl, dl
je 0x44898a
cmp dword [0x58fb74], 0
je 0x44898a
mov edx, dword [esp + 0x64]
mov ecx, dword [0x4edb80]
mov edi, dword [0x4ebfc8]
add ecx, edx
jmp 0x4489a6
mov ecx, dword [0x4edb80]
mov edi, dword [0x4ebfc8]
add ebx, ecx
mov dword [esp + 0x10], ebx
test dl, dl
je 0x4489ac
sub ecx, dword [0x4ed660]
add ebx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x9c], edi
mov dword [esp + 0x94], ebx
imul esi, dword [0x4edb8c]
sub eax, esi
mov dword [esp + 0x54], eax
cdq
sub eax, edx
sar eax, 1
add edi, eax
mov dword [esp + 0x1c], edi
jmp case.0x44889b.0
mov eax, dword [0x4ebfc8]
imul edx, ecx
inc esi
imul esi, ecx
add esi, edi
add edx, eax
cmp esi, edx
jl 0x448a39
mov cl, byte [esp + 0x17]
test cl, cl
je 0x448a0e
cmp dword [0x58fb74], 0
je 0x448a0e
mov ecx, dword [0x4edb80]
mov edi, eax
mov eax, dword [esp + 0x64]
add ecx, eax
add ebx, ecx
jmp 0x448a27
mov edi, eax
mov eax, dword [0x4edb80]
add ebx, eax
mov dword [esp + 0x10], ebx
test cl, cl
je 0x448a2b
sub eax, dword [0x4ed660]
add ebx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x9c], edi
mov dword [esp + 0x94], ebx
xor eax, eax
mov dword [esp + 0x54], eax
cdq
sub eax, edx
sar eax, 1
add edi, eax
mov dword [esp + 0x1c], edi
jmp case.0x44889b.0
imul eax, dword [esp + 0x64]
mov ecx, esi
imul ecx, dword [0x4ed660]
cmp eax, ecx
jle 0x448a77
sub eax, ecx
mov dword [esp + 0x54], eax
cdq
sub eax, edx
sar eax, 1
add ebx, eax
mov dword [esp + 0x10], ebx
jmp case.0x44889b.0
xor eax, eax
mov dword [esp + 0x54], eax
cdq
sub eax, edx
sar eax, 1
add ebx, eax
mov dword [esp + 0x10], ebx
jmp case.0x44889b.0
cmp dword [0x58fb94], 0
jne case.0x44889b.1
push 0x64
lea edx, [esp + 0x850]
push 0
push edx
call fcn.004112a0
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x94]
add esp, 0xc
mov ecx, esi
sub ecx, eax
push ecx
lea edx, [esp + eax + 0x9b8]
push edx
lea eax, [esp + 0x854]
push eax
call fcn.00409560
mov eax, dword [esp + 0x60]
cdq
sub eax, edx
inc esi
add esp, 0xc
sar eax, 1
cmp dword [0x58fe34], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x78], 3
jne 0x448afb
add dword [esp + 0x1c], eax
jmp 0x448aff
add dword [esp + 0x10], eax
mov ecx, dword [0x544f30]
mov edx, dword [0x4ab5a8]
mov eax, dword [0x4ab594]
push ecx
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x20]
push eax
push 0
push ecx
push edx
mov edx, dword [esp + 0xb4]
lea ecx, [esp + 0x864]
mov dword [esp + 0x6c], 0
call fcn.00443ef0
jmp case.0x44889b.0
cmp dword [0x58fb94], 0
jne case.0x44889b.1
mov ecx, dword [esp + 0x2c]
mov eax, ecx
sub eax, dword [esp + 0x88]
mov dword [esp + 0x78], 2
imul eax, dword [0x4ab6cc]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x54]
inc ecx
mov dword [0x54886c], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x88], ecx
jmp case.0x44889b.0
cmp dword [esp + 0x30], 0
je 0x448ba2
inc dword [esp + 0x2c]
mov dword [esp + 0x30], 0
jmp 0x448829
cmp dword [0x58fe34], 0
je 0x448bc7
mov eax, dword [0x4ab6cc]
mov ecx, dword [0x4ed550]
sub dword [esp + 0x1c], eax
inc dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jmp 0x448829
mov eax, dword [0x4edb80]
mov edx, dword [0x4ebfc8]
add dword [esp + 0x10], eax
inc dword [esp + 0x2c]
mov dword [esp + 0x1c], edx
jmp 0x448829
mov eax, 2
cmp dword [esp + 0x78], eax
jne 0x448bf7
add dword [esp + 0x2c], eax
jmp case.0x44889b.0
mov edx, dword [esp + 0x1c]
mov eax, dword [0x4ab6cc]
add eax, edx
cmp eax, dword [esp + 0x90]
jl case.0x44889b.0
mov edx, dword [esp + 0x10]
mov eax, dword [0x4edb80]
add eax, edx
cmp eax, dword [esp + 0x80]
jl case.0x44889b.0
mov edx, dword [esp + 0x98]
cmp dword [esp + 0x1c], edx
jg case.0x44889b.0
mov eax, dword [esp + 0x84]
cmp dword [esp + 0x10], eax
jg case.0x44889b.0
mov al, cl
mov ecx, dword [esp + 0x2c]
mov cl, byte [esp + ecx + 0x9b5]
mov byte [esp + 0x40], al
mov byte [esp + 0x41], cl
test al, al
je case.0x44889b.0
test cl, cl
je case.0x44889b.0
mov eax, dword [0x497dc4]
cdq
idiv dword [0x497de4]
cmp dword [0x497dd8], 1
mov ebx, dword [0x497dc8]
mov edi, eax
jne 0x448c92
cdq
sub eax, edx
sar eax, 1
mov edi, eax
push 0
mov byte [0x497b60], 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
xor eax, eax
push esi
lea edx, [esp + 0xe0]
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe0], eax
mov eax, dword [0x497d78]
push edx
push eax
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf0], edi
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [0x58fe34], 0
mov esi, dword [sym.imp.GDI32.dll_TextOutA]
push 2
jne 0x448d16
mov edx, dword [0x497d78]
lea ecx, [esp + 0x44]
push ecx
push 0
push 0
push edx
call esi
cmp dword [0x543990], 0
je 0x448d54
push 2
lea eax, [esp + 0x44]
push eax
push 0
push 1
jmp 0x448d4b
mov eax, dword [0x4edb8c]
mov ecx, dword [0x497d78]
lea edx, [esp + 0x44]
push edx
push 0
lea eax, [eax + eax*2]
push eax
push ecx
call esi
cmp dword [0x543990], 0
je 0x448d54
mov eax, dword [0x4edb8c]
push 2
lea edx, [esp + 0x44]
push edx
push 0
lea eax, [eax + eax*2 + 1]
push eax
mov ecx, dword [0x497d78]
push ecx
call esi
mov edi, dword [0x4967f0]
mov edx, dword [esp + 0xb4]
mov eax, dword [esp + 0x1c]
mov esi, edi
sub esi, dword [esp + 0x10]
lea eax, [eax + eax*2]
dec esi
imul esi, edx
add esi, eax
mov eax, dword [0x4edb8c]
lea ecx, [eax + eax*2]
mov eax, dword [0x497dc4]
add edx, ecx
mov dword [esp + 0xa0], edx
cdq
idiv dword [0x497de4]
cmp dword [0x497dd8], 1
jne 0x448d9f
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + eax*2]
lea eax, [eax*8 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 3
cdq
and edx, 3
add eax, edx
mov edx, dword [0x497dbc]
mov ebx, eax
mov eax, dword [0x497dc8]
sar ebx, 2
add ebx, ebx
add ebx, ebx
dec eax
imul eax, ebx
add ecx, ebx
cmp dword [0x58fcbc], 0
lea ecx, [ecx + ecx*2]
mov dword [esp + 0x7c], edx
mov edx, eax
mov dword [esp + 0x58], ecx
mov ecx, dword [0x496b94]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], edx
je 0x4490b7
cmp dword [0x52e5bc], 0
je 0x4490b7
sub edi, dword [0x54acf4]
mov edx, dword [0x54a8c4]
sub edi, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x1c]
dec edi
imul edi, dword [esp + 0xb4]
add eax, edx
lea eax, [eax + eax*2]
add edi, eax
mov edx, edi
mov edi, dword [0x4ed660]
mov dword [esp + 0x68], 0
test edi, edi
jle 0x448f56
mov eax, dword [esp + 0x3c]
cmp dword [0x4edb8c], 0
mov dword [esp + 0x38], 0
jle 0x448f33
mov edi, dword [esp + 0x7c]
lea edi, [eax + edi + 6]
mov dword [esp + 0x4c], edi
mov edi, 3
sub edi, ebx
lea eax, [eax + edi*2]
add eax, dword [esp + 0x7c]
lea ecx, [ecx]
movzx edi, byte [ebx + eax - 3]
movzx ebx, byte [ebx + eax - 6]
lea edi, [ebx + edi*2]
mov ebx, dword [esp + 0x30]
movzx ebx, byte [eax + ebx]
add edi, ebx
movzx ebx, byte [eax - 3]
add edi, ebx
mov ebx, dword [esp + 0x4c]
movzx ebx, byte [ebx - 3]
add edi, ebx
movzx ebx, byte [eax - 6]
lea edi, [ebx + edi*2]
mov ebx, dword [esp + 0x4c]
movzx ebx, byte [ebx - 6]
add edi, ebx
movzx ebx, byte [eax]
add edi, ebx
mov ebx, dword [esp + 0x4c]
movzx ebx, byte [ebx]
add edi, ebx
movzx ebx, byte [edx + ecx]
shl ebx, 8
sar edi, 4
sub ebx, edi
movzx ebx, byte [ebx + 0x49b687]
mov byte [edx + ecx], bl
movzx ebx, byte [edx + ecx + 1]
inc edx
shl ebx, 8
sub ebx, edi
movzx ebx, byte [ebx + 0x49b687]
mov byte [edx + ecx], bl
movzx ebx, byte [edx + ecx + 1]
inc edx
shl ebx, 8
sub ebx, edi
movzx ebx, byte [ebx + 0x49b687]
mov edi, 9
add dword [esp + 0x3c], edi
add dword [esp + 0x4c], edi
add eax, edi
mov edi, dword [esp + 0x38]
mov byte [edx + ecx], bl
mov ebx, dword [esp + 0x30]
inc edi
inc edx
cmp edi, dword [0x4edb8c]
mov dword [esp + 0x38], edi
jl 0x448e80
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x58]
inc dword [esp + 0x68]
mov edi, dword [0x4ed660]
sub edx, dword [esp + 0xa0]
cmp dword [esp + 0x68], edi
mov dword [esp + 0x3c], eax
jl 0x448e4e
mov dword [esp + 0x68], 0
test edi, edi
jle 0x449269
mov edx, dword [esp + 0x28]
lea ebx, [ebx]
cmp dword [0x4edb8c], 0
mov dword [esp + 0x38], 0
jle 0x44908e
mov eax, dword [esp + 0x7c]
lea edi, [edx + eax + 6]
mov dword [esp + 0x3c], edi
mov edi, 3
sub edi, ebx
lea edi, [edx + edi*2]
add edi, eax
lea ecx, [ecx]
movzx eax, byte [edi + ebx - 6]
movzx edx, byte [edi + ebx - 3]
lea edx, [eax + edx*2]
movzx eax, byte [edi + ebx]
add edx, eax
movzx eax, byte [edi - 3]
add edx, eax
mov eax, dword [esp + 0x3c]
movzx ebx, byte [eax - 3]
add edx, ebx
movzx ebx, byte [edi - 6]
lea edx, [ebx + edx*2]
movzx ebx, byte [eax - 6]
movzx eax, byte [eax]
add edx, ebx
movzx ebx, byte [edi]
add edx, ebx
mov ebx, dword [esp + 0xbc]
add edx, eax
movzx eax, byte [ecx + esi]
shl eax, 8
sar edx, 4
movzx ebx, byte [edx + ebx]
sub eax, edx
movzx eax, byte [eax + 0x49b687]
add eax, ebx
cmp eax, 0xff
jle 0x449006
mov eax, 0xff
mov ebx, dword [esp + 0x70]
mov byte [ecx + esi], al
movzx eax, byte [ecx + esi + 1]
movzx ebx, byte [edx + ebx]
inc esi
shl eax, 8
sub eax, edx
movzx eax, byte [eax + 0x49b687]
add eax, ebx
cmp eax, 0xff
jle 0x449031
mov eax, 0xff
mov ebx, dword [esp + 0x34]
mov byte [ecx + esi], al
movzx eax, byte [ecx + esi + 1]
inc esi
shl eax, 8
sub eax, edx
movzx eax, byte [eax + 0x49b687]
movzx edx, byte [edx + ebx]
add eax, edx
cmp eax, 0xff
jle 0x44905c
mov eax, 0xff
mov ebx, dword [esp + 0x30]
mov byte [ecx + esi], al
mov eax, 9
add dword [esp + 0x28], eax
add dword [esp + 0x3c], eax
add edi, eax
mov eax, dword [esp + 0x38]
inc eax
inc esi
cmp eax, dword [0x4edb8c]
mov dword [esp + 0x38], eax
jl 0x448fa0
mov edi, dword [0x4ed660]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x68]
sub edx, dword [esp + 0x58]
sub esi, dword [esp + 0xa0]
inc eax
cmp eax, edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x68], eax
jl 0x448f70
jmp 0x449269
mov edi, dword [0x4ed660]
mov dword [esp + 0x4c], 0
test edi, edi
jle 0x449269
lea ecx, [ecx]
cmp dword [0x4edb8c], 0
mov dword [esp + 0x3c], 0
jle 0x44924c
mov edi, dword [esp + 0x7c]
lea eax, [edx + edi + 6]
mov dword [esp + 0x30], eax
mov eax, 3
sub eax, ebx
lea eax, [edx + eax*2]
add eax, edi
mov dword [esp + 0x38], eax
movzx edi, byte [eax + ebx]
movzx edx, byte [ebx + eax - 3]
lea edx, [edi + edx*2]
movzx edi, byte [ebx + eax - 6]
add edx, edi
movzx edi, byte [eax - 3]
add edx, edi
mov edi, dword [esp + 0x30]
movzx edi, byte [edi - 3]
add edx, edi
movzx edi, byte [eax - 6]
movzx eax, byte [eax]
lea edx, [edi + edx*2]
mov edi, dword [esp + 0x30]
movzx edi, byte [edi - 6]
add edx, edi
add edx, eax
mov eax, dword [esp + 0x30]
movzx eax, byte [eax]
add edx, eax
movzx eax, byte [ecx + esi]
shl eax, 8
sar edx, 4
sub eax, edx
movzx edi, byte [eax + 0x49b687]
mov eax, dword [esp + 0xbc]
movzx eax, byte [edx + eax]
add edi, eax
cmp edi, 0xff
mov eax, 0xff
jg 0x449172
mov eax, edi
mov byte [ecx + esi], al
movzx eax, byte [ecx + esi + 1]
inc esi
shl eax, 8
sub eax, edx
movzx edi, byte [eax + 0x49b687]
mov eax, dword [esp + 0x70]
movzx eax, byte [edx + eax]
add edi, eax
cmp edi, 0xff
mov eax, 0xff
jg 0x4491a0
mov eax, edi
mov byte [ecx + esi], al
movzx eax, byte [ecx + esi + 1]
inc esi
shl eax, 8
sub eax, edx
movzx edi, byte [eax + 0x49b687]
mov eax, dword [esp + 0x34]
movzx eax, byte [edx + eax]
add edi, eax
cmp edi, 0xff
mov eax, 0xff
jg 0x4491ce
mov eax, edi
mov byte [ecx + esi], al
inc esi
cmp dword [0x52e5bc], 0
je 0x449217
movzx eax, byte [ecx + esi]
shl eax, 8
sub eax, edx
movzx eax, byte [eax + 0x49b687]
mov byte [ecx + esi], al
movzx eax, byte [ecx + esi + 1]
shl eax, 8
sub eax, edx
movzx eax, byte [eax + 0x49b687]
mov byte [ecx + esi + 1], al
movzx eax, byte [ecx + esi + 2]
shl eax, 8
sub eax, edx
mov dl, byte [eax + 0x49b687]
mov byte [ecx + esi + 2], dl
mov eax, dword [esp + 0x38]
inc dword [esp + 0x3c]
mov edx, 9
add dword [esp + 0x28], edx
add dword [esp + 0x30], edx
add eax, edx
mov edx, dword [esp + 0x3c]
cmp edx, dword [0x4edb8c]
mov dword [esp + 0x38], eax
jl 0x449101
mov edi, dword [0x4ed660]
mov edx, dword [esp + 0x28]
sub edx, dword [esp + 0x58]
inc dword [esp + 0x4c]
sub esi, dword [esp + 0xa0]
cmp dword [esp + 0x4c], edi
mov dword [esp + 0x28], edx
jl 0x4490d0
add dword [esp + 0x2c], 2
cmp dword [0x58fcbc], 0
je 0x449324
cmp dword [0x52e5bc], 0
je 0x449324
cmp byte [0x58f9cb], 0
je 0x4492f1
mov eax, dword [0x49ab6c]
cmp dword [eax + 0x514], 0
je 0x4492f1
mov ecx, dword [0x54acf4]
mov edx, dword [0x4edb8c]
mov eax, dword [0x54a8c4]
mov ebx, dword [0x496b50]
push 0
add edi, ecx
lea esi, [eax + edx]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x10]
push 0xcc0020
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x50]
push ebx
push edi
push esi
push edx
push eax
push ecx
jmp 0x4493a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x496b50]
mov esi, dword [0x54a8c4]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [0x54acf4]
add edx, edi
push edx
mov edx, dword [0x4edb8c]
add esi, edx
push esi
jmp 0x449399
cmp byte [0x58f9cb], 0
je 0x44937b
mov ecx, dword [0x49ab6c]
cmp dword [ecx + 0x514], 0
je 0x44937b
mov esi, dword [0x496b50]
mov ebx, dword [0x4edb8c]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
push 0xcc0020
push eax
mov eax, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x50]
push esi
push edi
push ebx
push eax
push ecx
push edx
jmp 0x4493a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x496b50]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [0x4edb8c]
push edi
push edx
push eax
mov eax, dword [esp + 0x60]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x30], ecx
xor esi, esi
mov dword [esp + 0x38], ecx
lea eax, [esp + eax + 0x9b4]
cmp dword [0x58fb94], 0
movzx edx, byte [eax]
jne 0x449499
cmp edx, 0x28
jne 0x44947e
lea edi, [edx - 0x27]
inc eax
cmp dword [0x58fb94], 0
movzx edx, byte [eax]
jne 0x449526
cmp edx, 0x28
jne 0x44950b
lea edi, [edx - 0x27]
inc eax
cmp dword [0x58fb94], 0
movzx edx, byte [eax]
jne 0x4495b7
cmp edx, 0x28
jne 0x44959c
lea edi, [edx - 0x27]
inc eax
cmp dword [0x58fb94], 0
movzx edx, byte [eax]
jne 0x449648
cmp edx, 0x28
jne 0x44962d
lea edi, [edx - 0x27]
inc eax
mov edx, dword [esp + 0x38]
add edx, 4
cmp edx, 0x80
mov dword [esp + 0x38], edx
jl 0x4493bf
xor esi, esi
mov byte [esp + ecx + 0x656], 0
mov byte [esp + ecx + 0x655], 0
mov byte [esp + ecx + 0x654], 0
cmp dword [0x58fe34], esi
je 0x4496be
mov eax, dword [0x4edb80]
add dword [esp + 0x10], eax
jmp 0x4496c8
cmp edx, 0x2f
jne 0x44948b
lea esi, [edx - 0x2e]
jmp 0x4493db
cmp edx, 0x29
jne 0x449499
xor esi, esi
xor edi, edi
jmp 0x4493db
test edx, edx
je 0x44944a
cmp edx, 0x81
jl 0x4494ad
cmp edx, 0x9f
jle 0x4494bc
lea ebx, [edx - 0xe0]
cmp ebx, 0x1c
ja 0x4493db
test esi, esi
je 0x4494c8
add eax, 2
jmp 0x4493dc
test edi, edi
jne 0x4494e5
mov byte [esp + ecx + 0x654], dl
mov dl, byte [eax + 1]
inc eax
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
jmp 0x4493db
movzx edx, byte [0x4ed348]
mov byte [esp + ecx + 0x654], dl
movzx edx, byte [0x4ed349]
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
add eax, 2
jmp 0x4493dc
cmp edx, 0x2f
jne 0x449518
lea esi, [edx - 0x2e]
jmp 0x4493f8
cmp edx, 0x29
jne 0x449526
xor esi, esi
xor edi, edi
jmp 0x4493f8
test edx, edx
je 0x44944a
cmp edx, 0x81
jl 0x44953e
cmp edx, 0x9f
jle 0x44954d
lea ebx, [edx - 0xe0]
cmp ebx, 0x1c
ja 0x4493f8
test esi, esi
je 0x449559
add eax, 2
jmp 0x4493f9
test edi, edi
jne 0x449576
mov byte [esp + ecx + 0x654], dl
mov dl, byte [eax + 1]
inc eax
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
jmp 0x4493f8
movzx edx, byte [0x4ed348]
mov byte [esp + ecx + 0x654], dl
movzx edx, byte [0x4ed349]
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
add eax, 2
jmp 0x4493f9
cmp edx, 0x2f
jne 0x4495a9
lea esi, [edx - 0x2e]
jmp 0x449415
cmp edx, 0x29
jne 0x4495b7
xor esi, esi
xor edi, edi
jmp 0x449415
test edx, edx
je 0x44944a
cmp edx, 0x81
jl 0x4495cf
cmp edx, 0x9f
jle 0x4495de
lea ebx, [edx - 0xe0]
cmp ebx, 0x1c
ja 0x449415
test esi, esi
je 0x4495ea
add eax, 2
jmp 0x449416
test edi, edi
jne 0x449607
mov byte [esp + ecx + 0x654], dl
mov dl, byte [eax + 1]
inc eax
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
jmp 0x449415
movzx edx, byte [0x4ed348]
mov byte [esp + ecx + 0x654], dl
movzx edx, byte [0x4ed349]
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
add eax, 2
jmp 0x449416
cmp edx, 0x2f
jne 0x44963a
lea esi, [edx - 0x2e]
jmp 0x449432
cmp edx, 0x29
jne 0x449648
xor esi, esi
xor edi, edi
jmp 0x449432
test edx, edx
je 0x44944a
cmp edx, 0x81
jl 0x449660
cmp edx, 0x9f
jle 0x44966f
lea ebx, [edx - 0xe0]
cmp ebx, 0x1c
ja 0x449432
test esi, esi
je 0x44967b
add eax, 2
jmp 0x449433
test edi, edi
jne 0x449698
mov byte [esp + ecx + 0x654], dl
mov dl, byte [eax + 1]
inc eax
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
jmp 0x449432
movzx edx, byte [0x4ed348]
mov byte [esp + ecx + 0x654], dl
movzx edx, byte [0x4ed349]
inc ecx
mov byte [esp + ecx + 0x654], dl
inc ecx
add eax, 2
jmp 0x449433
mov edx, dword [0x4ab6cc]
add dword [esp + 0x1c], edx
mov ebx, 3
lea ecx, [ecx]
cmp ecx, ebx
jle 0x44974b
cmp byte [0x58faba], 1
je 0x44974b
cmp byte [0x4ed348], 0
je 0x449716
mov al, byte [esp + esi + 0x654]
mov dl, byte [0x4ed348]
mov edi, 0x4ed348
cmp dl, al
jne 0x44970c
mov dl, byte [edi + 1]
cmp dl, byte [esp + esi + 0x655]
je 0x449792
mov dl, byte [edi + 2]
add edi, 2
test dl, dl
jne 0x4496f8
cmp byte [0x53bf38], 0
je 0x44974b
mov al, byte [esp + esi + 0x656]
mov dl, byte [0x53bf38]
mov edi, 0x53bf38
cmp dl, al
jne 0x449741
mov dl, byte [edi + 1]
cmp dl, byte [esp + esi + 0x657]
je 0x449792
mov dl, byte [edi + 2]
add edi, 2
test dl, dl
jne 0x449731
mov eax, esi
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
cmp dword [0x58fe34], 0
je 0x44979d
mov eax, dword [0x4edb80]
mov edx, dword [0x4ebfc4]
imul ecx, eax
add ecx, dword [esp + 0x10]
dec edx
imul edx, eax
mov eax, dword [0x4ed550]
add edx, eax
cmp ecx, edx
jle case.0x44889b.0
mov ecx, dword [0x4ab6cc]
add dword [esp + 0x1c], ecx
mov dword [esp + 0x30], 1
jmp 0x4497ec
add esi, 2
add ebx, 2
jmp 0x4496d0
mov eax, dword [0x4ab6cc]
mov edx, dword [0x4ed870]
imul ecx, eax
add ecx, dword [esp + 0x1c]
dec edx
imul edx, eax
mov eax, dword [0x4ebfc8]
add edx, eax
cmp ecx, edx
jle case.0x44889b.0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
add eax, dword [0x4edb80]
cmp dword [0x58fb74], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 1
je case.0x44889b.0
cmp byte [esp + 0x17], 0
je case.0x44889b.0
add eax, dword [esp + 0x64]
mov dword [esp + 0x10], eax
cmp byte [esp + 0x63], 0
jne 0x448829
mov edx, dword [0x4965ec]
mov eax, dword [0x4967f0]
xor ebx, ebx
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], eax
mov ecx, 1
or edx, 0xffffffff
mov eax, 3
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x610], ebx
mov dword [esp + 0x5c0], ecx
mov dword [esp + 0x5bc], ebx
mov dword [esp + 0x630], ebx
mov dword [esp + 0x5d4], ebx
mov dword [esp + 0x638], edx
mov dword [esp + 0x634], eax
mov dword [esp + 0x63c], ebx
mov dword [esp + 0x640], ecx
mov dword [esp + 0x644], ebx
mov dword [esp + 0x64c], ebx
mov dword [esp + 0x648], ebx
mov byte [esp + 0x3bc], bl
mov dword [esp + 0x378], ebx
mov dword [esp + 0x328], ecx
mov dword [esp + 0x324], ebx
mov dword [esp + 0x398], ebx
mov dword [esp + 0x33c], ebx
mov dword [esp + 0x3a0], edx
mov dword [esp + 0x39c], eax
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x3a8], ecx
mov dword [esp + 0x3ac], ebx
mov dword [esp + 0x3b4], ebx
mov dword [esp + 0x3b0], ebx
mov byte [esp + 0x124], bl
mov byte [esp + 0x1390], al
cmp dword [0x58fe14], ebx
je 0x449a89
mov edi, dword [esp + 0x24]
mov esi, dword [0x591610]
mov eax, dword [esp + 0x20]
lea edx, [edi + 1]
cmp esi, edx
mov dword [esp + 0x28], edx
jge 0x44991d
cmp eax, ecx
jne 0x44991d
xor eax, eax
mov dword [esp + 0x20], eax
cmp edi, ecx
jg 0x44992c
cmp eax, 0xffffffff
jne 0x44992c
xor eax, eax
mov dword [esp + 0x20], eax
cmp esi, edx
mov edx, dword [0x54a9dc]
lea esi, [edx*4]
jl 0x44995f
mov edi, edx
imul edi, edi, 0x294
mov dword [esi + 0x53a1c8], ecx
cmp eax, ecx
jne 0x449957
mov dword [edi + 0x59ce08], ecx
jmp 0x449965
mov dword [edi + 0x59ce08], ebx
jmp 0x449965
mov dword [esi + 0x53a1c8], ebx
cmp dword [esp + 0x24], ecx
jle 0x4499a1
mov ecx, dword [0x54acf8]
lea edi, [ecx*4]
imul ecx, ecx, 0x294
mov dword [edi + 0x53a1c8], 1
cmp eax, 0xffffffff
jne 0x449999
mov dword [ecx + 0x59ce08], 1
jmp 0x4499b1
mov dword [ecx + 0x59ce08], ebx
jmp 0x4499b1
mov edi, dword [0x54acf8]
add edi, edi
add edi, edi
mov dword [edi + 0x53a1c8], ebx
mov ecx, dword [0x49b484]
mov dword [esp + 0x58], ecx
mov ecx, edx
imul ecx, ecx, 0x294
mov edx, dword [ecx + 0x59cdf0]
mov eax, dword [ecx + 0x59cdec]
mov dword [esp + 0x34], edx
cdq
idiv dword [ecx + 0x59ce0c]
mov ebx, 1
mov dword [0x49b484], ebx
cmp dword [ecx + 0x59ce00], ebx
jne 0x4499f2
cdq
sub eax, edx
sar eax, 1
mov ebx, dword [esi + 0x4ab6d0]
mov edx, dword [esp + 0x34]
mov ecx, dword [esi + 0x5429f0]
lea edx, [ebx + edx + 1]
push edx
lea edx, [eax + ecx + 1]
call fcn.0044e920
mov ecx, dword [0x54acf8]
imul ecx, ecx, 0x294
mov eax, dword [ecx + 0x59cdec]
mov esi, dword [ecx + 0x59cdf0]
cdq
idiv dword [ecx + 0x59ce0c]
add esp, 4
cmp dword [ecx + 0x59ce00], 1
jne 0x449a40
cdq
sub eax, edx
sar eax, 1
mov ebx, dword [edi + 0x4ab6d0]
mov ecx, dword [edi + 0x5429f0]
lea edx, [ebx + esi + 1]
push edx
lea edx, [ecx + eax + 1]
call fcn.0044e920
add esp, 4
mov eax, 0x53b798
call fcn.004566d0
mov ecx, dword [esp + 0x18]
push 0x53b798
push 0
push 1
xor edx, edx
call fcn.0045f070
mov eax, dword [esp + 0x58]
mov dword [0x49b484], eax
jmp 0x449e04
mov eax, dword [0x496e34]
cdq
idiv dword [0x496e54]
mov edi, eax
cmp dword [0x496e48], ecx
jne 0x449aa6
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov esi, dword [0x496e38]
push ebx
mov dword [esp + 0x70], edi
mov dword [esp + 0x54], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x5d4], eax
mov eax, esi
mov ecx, edi
lea ebx, [esp + 0x5d8]
call fcn.00469800
mov ecx, dword [esp + 0x61c]
mov edx, dword [esp + 0x5d4]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x33c]
xor ebx, ebx
cmp eax, ebx
je 0x449b3f
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x378], ebx
je 0x449b2a
mov eax, dword [esp + 0x384]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x378]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], ebx
mov dword [esp + 0x33c], ebx
mov dword [esp + 0x398], ebx
mov byte [esp + 0x124], bl
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x33c], eax
mov eax, esi
mov ecx, edi
lea ebx, [esp + 0x340]
call fcn.00469800
mov edx, dword [esp + 0x384]
mov eax, dword [esp + 0x33c]
push edx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x4edba0]
mov eax, dword [0x53b594]
mov edx, dword [0x496b50]
push ecx
sub eax, edi
push eax
push edx
push esi
push edi
push ecx
push eax
lea eax, [esp + 0x3d8]
call fcn.00403520
mov eax, dword [0x53c458]
mov ecx, dword [0x53b594]
mov edx, dword [0x496b50]
sub eax, esi
push eax
sub ecx, edi
push ecx
push edx
push esi
push edi
push eax
push ecx
lea eax, [esp + 0x140]
call fcn.00403520
mov eax, dword [esp + 0x24]
inc eax
cmp dword [0x591610], eax
mov dword [esp + 0x28], eax
mov ebx, 1
jge 0x449be5
cmp dword [esp + 0x20], ebx
jne 0x449be5
mov dword [esp + 0x20], 0
cmp dword [esp + 0x24], ebx
jg 0x449bfa
cmp dword [esp + 0x20], 0xffffffff
jne 0x449bfa
mov dword [esp + 0x20], 0
mov ecx, dword [0x4edba0]
mov eax, dword [0x53b594]
mov edx, dword [esp + 0x5d4]
push ecx
sub eax, edi
push eax
push edx
push esi
push edi
push ecx
push eax
mov eax, 0x496938
call fcn.00403520
mov eax, dword [0x591610]
cmp eax, dword [esp + 0x28]
jl 0x449c68
lea eax, [esp + 0xa4]
cmp dword [esp + 0x20], ebx
jne 0x449c4a
mov ecx, dword [0x4edba0]
push ecx
push 0x496938
push 0x496bd0
jmp 0x449c5b
mov edx, dword [0x4edba0]
push edx
push 0x496938
push 0x496e68
mov ecx, dword [0x53b594]
sub ecx, edi
call fcn.00465150
cmp byte [0x58f9cb], 0
je 0x449cd9
mov eax, dword [0x49ab6c]
cmp dword [eax + 0x514], 0
je 0x449cd9
mov ecx, dword [0x4edba0]
mov ebx, dword [0x53b594]
mov esi, dword [0x496b50]
push 0
mov dword [esp + 0x74], ecx
sub ebx, edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x70]
push 0xcc0020
push eax
mov eax, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x50]
push esi
push eax
push edi
push ecx
push ebx
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov esi, dword [esp + 0x50]
mov ebx, 1
jmp 0x449d03
mov ecx, dword [0x4edba0]
mov eax, dword [0x53b594]
mov edx, dword [0x496b50]
push 0xcc0020
push ecx
sub eax, edi
push eax
push edx
push esi
push edi
push ecx
push eax
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [0x53c458]
mov ecx, dword [0x53b594]
mov edx, dword [esp + 0x33c]
sub eax, esi
push eax
sub ecx, edi
push ecx
push edx
push esi
push edi
push eax
push ecx
mov eax, 0x496938
call fcn.00403520
cmp dword [esp + 0x24], ebx
jle 0x449d72
cmp dword [esp + 0x20], 0xffffffff
jne 0x449d4b
mov eax, dword [0x53c458]
sub eax, esi
push eax
push 0x496938
push 0x497100
jmp 0x449d5e
mov ecx, dword [0x53c458]
sub ecx, esi
push ecx
push 0x496938
push 0x497398
mov ecx, dword [0x53b594]
sub ecx, edi
lea eax, [esp + 0xb0]
call fcn.00465150
cmp byte [0x58f9cb], 0
je 0x449dd8
mov edx, dword [0x49ab6c]
cmp dword [edx + 0x514], 0
je 0x449dd8
mov eax, dword [0x496b50]
mov ebx, dword [0x53c458]
mov esi, dword [0x53b594]
sub ebx, dword [esp + 0x50]
push 0
mov dword [esp + 0x74], eax
sub esi, edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x70]
push 0xcc0020
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x50]
push edx
push eax
push edi
push ebx
push esi
push ecx
jmp 0x449dfe
mov eax, dword [0x53c458]
mov ecx, dword [0x53b594]
mov edx, dword [0x496b50]
push 0xcc0020
sub eax, esi
push eax
sub ecx, edi
push ecx
push edx
push esi
push edi
push eax
mov eax, dword [esp + 0x60]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
lea ebx, [ebx]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x10]
push 1
push 0x202
push 0x202
push edx
lea eax, [esp + 0x118]
push eax
call esi
test eax, eax
jne 0x449e10
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x10]
push 1
push 0x102
push 0x102
push edx
lea eax, [esp + 0x118]
push eax
call esi
test eax, eax
jne 0x449e32
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
lea ebx, [ebx]
xor edi, edi
cmp dword [0x58fe6c], edi
jne 0x44ac9b
push 1
push edi
push edi
push edi
lea ecx, [esp + 0xfc]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x44a6ab
mov eax, dword [0x49ac78]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xec]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x449eb7
lea edx, [esp + 0xec]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xec]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esi + 0xa2c], 0x200
jne 0x44a475
mov ecx, dword [esp + 0x20]
mov ebx, dword [0x54a9dc]
mov esi, dword [0x53b594]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], edi
cmp dword [0x58fe14], edi
je 0x449ff1
mov edx, dword [esp + 0x28]
cmp dword [0x591610], edx
jl 0x449f6c
mov eax, dword [esp + 0x18]
mov edi, dword [ebx*4 + 0x5429f0]
mov esi, dword [eax + 0xa30]
cmp esi, edi
jl 0x449f6c
mov ecx, ebx
imul ecx, ecx, 0x294
mov eax, dword [ecx + 0x59cdec]
cdq
idiv dword [ecx + 0x59ce0c]
cmp dword [ecx + 0x59ce00], 1
jne 0x449f3d
cdq
sub eax, edx
sar eax, 1
add edi, eax
cmp esi, edi
jg 0x449f6c
mov edx, dword [esp + 0x18]
mov eax, dword [ebx*4 + 0x4ab6d0]
mov edx, dword [edx + 0xa34]
cmp edx, eax
jl 0x449f6c
mov ecx, dword [ecx + 0x59cdf0]
add eax, ecx
cmp edx, eax
jg 0x449f6c
mov dword [esp + 0x20], 1
cmp dword [esp + 0x24], 1
jle 0x44a0b3
mov edi, dword [0x54acf8]
mov eax, dword [esp + 0x18]
mov ebx, dword [edi*4 + 0x5429f0]
mov esi, dword [eax + 0xa30]
cmp esi, ebx
jl 0x44a0b3
mov ecx, edi
imul ecx, ecx, 0x294
mov eax, dword [ecx + 0x59cdec]
cdq
idiv dword [ecx + 0x59ce0c]
cmp dword [ecx + 0x59ce00], 1
jne 0x449fb9
cdq
sub eax, edx
sar eax, 1
add ebx, eax
cmp esi, ebx
jg 0x44a0b3
mov edx, dword [esp + 0x18]
mov eax, dword [edi*4 + 0x4ab6d0]
mov edx, dword [edx + 0xa34]
cmp edx, eax
jl 0x44a0b3
mov ecx, dword [ecx + 0x59cdf0]
add eax, ecx
cmp edx, eax
jg 0x44a0b3
jmp 0x44a0ab
mov eax, dword [esp + 0x28]
cmp dword [0x591610], eax
mov dword [esp + 0x20], edi
jl 0x44a055
mov eax, dword [0x4970cc]
cdq
idiv dword [0x4970ec]
cmp dword [0x4970e0], 1
jne 0x44a01b
cdq
sub eax, edx
sar eax, 1
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0xa30]
mov edi, esi
sub edi, eax
cmp ecx, edi
jle 0x44a055
cmp ecx, esi
jge 0x44a055
mov eax, dword [edx + 0xa34]
mov ecx, dword [0x4edba0]
cmp eax, ecx
jle 0x44a055
mov edx, dword [0x4970d0]
add edx, ecx
cmp eax, edx
jge 0x44a055
mov dword [esp + 0x20], 1
mov ecx, 1
cmp dword [esp + 0x24], ecx
jle 0x44a0b3
mov eax, dword [0x4975fc]
cdq
idiv dword [0x49761c]
cmp dword [0x497610], ecx
jne 0x44a079
cdq
sub eax, edx
sar eax, 1
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0xa30]
mov edi, esi
sub edi, eax
cmp ecx, edi
jle 0x44a0b3
cmp ecx, esi
jge 0x44a0b3
mov eax, dword [edx + 0xa34]
mov ecx, dword [0x53c458]
mov edx, ecx
sub edx, dword [0x497600]
cmp eax, edx
jle 0x44a0b3
cmp eax, ecx
jge 0x44a0b3
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], eax
je 0x44a46d
cmp dword [0x58fe14], 0
jne 0x44a2ec
mov ecx, dword [0x4edba0]
mov eax, dword [0x53b594]
mov edi, dword [esp + 0x6c]
mov edx, dword [esp + 0x5d4]
mov ebx, dword [esp + 0x50]
push ecx
sub eax, edi
push eax
push edx
push ebx
push edi
push ecx
push eax
mov eax, 0x496938
call fcn.00403520
mov eax, dword [0x591610]
cmp eax, dword [esp + 0x28]
jl 0x44a145
cmp dword [esp + 0x20], 1
lea eax, [esp + 0xa4]
jne 0x44a127
mov ecx, dword [0x4edba0]
push ecx
push 0x496938
push 0x496bd0
jmp 0x44a138
mov edx, dword [0x4edba0]
push edx
push 0x496938
push 0x496e68
mov ecx, dword [0x53b594]
sub ecx, edi
call fcn.00465150
cmp byte [0x58f9cb], 0
je 0x44a1b3
mov eax, dword [0x49ab6c]
cmp dword [eax + 0x514], 0
je 0x44a1b3
mov edi, dword [0x53b594]
mov ebx, dword [0x496b50]
mov esi, dword [0x4edba0]
sub edi, dword [esp + 0x6c]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x50]
push 0xcc0020
push eax
mov eax, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x50]
push ebx
push edx
push eax
push esi
push edi
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edi, dword [esp + 0x6c]
mov ebx, dword [esp + 0x50]
jmp 0x44a1dd
mov ecx, dword [0x4edba0]
mov eax, dword [0x53b594]
mov edx, dword [0x496b50]
push 0xcc0020
push ecx
sub eax, edi
push eax
push edx
push ebx
push edi
push ecx
push eax
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [0x53c458]
mov ecx, dword [0x53b594]
mov edx, dword [esp + 0x33c]
sub eax, ebx
push eax
sub ecx, edi
push ecx
push edx
push ebx
push edi
push eax
push ecx
mov eax, 0x496938
call fcn.00403520
cmp dword [esp + 0x24], 1
jle 0x44a24d
cmp dword [esp + 0x20], 0xffffffff
jne 0x44a226
mov eax, dword [0x53c458]
sub eax, ebx
push eax
push 0x496938
push 0x497100
jmp 0x44a239
mov ecx, dword [0x53c458]
sub ecx, ebx
push ecx
push 0x496938
push 0x497398
mov ecx, dword [0x53b594]
sub ecx, edi
lea eax, [esp + 0xb0]
call fcn.00465150
cmp byte [0x58f9cb], 0
je 0x44a2bb
mov edx, dword [0x49ab6c]
cmp dword [edx + 0x514], 0
je 0x44a2bb
mov edi, dword [0x53c458]
mov ebx, dword [0x53b594]
mov esi, dword [0x496b50]
sub edi, dword [esp + 0x50]
sub ebx, dword [esp + 0x6c]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x6c]
push 0xcc0020
push eax
mov eax, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x50]
push esi
push ecx
push edx
push edi
push ebx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x44a46d
mov eax, dword [0x53c458]
mov ecx, dword [0x53b594]
mov edx, dword [0x496b50]
push 0xcc0020
sub eax, ebx
push eax
sub ecx, edi
push ecx
push edx
push ebx
push edi
push eax
mov eax, dword [esp + 0x60]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x44a46d
mov ecx, dword [esp + 0x28]
cmp dword [0x591610], ecx
mov esi, dword [0x54a9dc]
mov ebx, 1
jl 0x44a332
cmp eax, ebx
jne 0x44a31e
mov edx, esi
imul edx, edx, 0x294
mov dword [esi*4 + 0x53a1c8], ebx
mov dword [edx + 0x59ce08], ebx
jmp 0x44a33d
mov eax, esi
imul eax, eax, 0x294
mov dword [eax + 0x59ce08], 0
jmp 0x44a33d
mov dword [esi*4 + 0x53a1c8], 0
mov ecx, dword [0x49b484]
mov dword [esp + 0x58], ecx
mov ecx, esi
imul ecx, ecx, 0x294
mov eax, dword [ecx + 0x59cdec]
mov edi, dword [ecx + 0x59cdf0]
cdq
idiv dword [ecx + 0x59ce0c]
mov dword [0x49b484], ebx
cmp dword [ecx + 0x59ce00], ebx
jne 0x44a375
cdq
sub eax, edx
sar eax, 1
mov ebx, dword [esi*4 + 0x4ab6d0]
mov ecx, dword [esi*4 + 0x5429f0]
lea edx, [ebx + edi + 1]
push edx
lea edx, [ecx + eax + 1]
call fcn.0044e920
add esp, 4
mov eax, 0x53b798
call fcn.004566d0
mov ecx, dword [esp + 0x18]
push 0x53b798
xor esi, esi
push esi
mov ebx, 1
push ebx
xor edx, edx
call fcn.0045f070
cmp dword [esp + 0x24], ebx
mov ecx, dword [0x54acf8]
lea edi, [ecx*4]
jle 0x44a3f7
cmp dword [esp + 0x20], 0xffffffff
mov dword [edi + 0x53a1c8], ebx
jne 0x44a3e7
mov eax, ecx
imul eax, eax, 0x294
mov dword [eax + 0x59ce08], ebx
jmp 0x44a3fd
mov edx, ecx
imul edx, edx, 0x294
mov dword [edx + 0x59ce08], esi
jmp 0x44a3fd
mov dword [edi + 0x53a1c8], esi
imul ecx, ecx, 0x294
mov eax, dword [ecx + 0x59cdec]
mov esi, dword [ecx + 0x59cdf0]
cdq
idiv dword [ecx + 0x59ce0c]
mov dword [0x49b484], ebx
cmp dword [ecx + 0x59ce00], ebx
jne 0x44a429
cdq
sub eax, edx
sar eax, 1
mov ebx, dword [edi + 0x4ab6d0]
mov ecx, dword [edi + 0x5429f0]
lea edx, [ebx + esi + 1]
push edx
lea edx, [ecx + eax + 1]
call fcn.0044e920
add esp, 4
mov eax, 0x53b798
call fcn.004566d0
mov ecx, dword [esp + 0x18]
push 0x53b798
push 0
push 1
xor edx, edx
call fcn.0045f070
mov eax, dword [esp + 0x58]
mov dword [0x49b484], eax
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edi, edi
mov eax, dword [0x49ab6c]
cmp dword [eax + 0xa2c], 0x20a
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
jne 0x44a4eb
cmp dword [eax + 0xa30], edi
jle 0x44a4aa
mov eax, dword [esp + 0x28]
cmp dword [0x591610], eax
jl 0x44a670
mov dword [esp + 0x24], eax
jmp 0x44a4bd
mov eax, 1
cmp dword [esp + 0x24], eax
jle 0x44a670
sub dword [esp + 0x24], eax
cmp byte [0x52e3b0], 0
je 0x44a6c0
push edi
push 0x52e3b0
cmp dword [0x653778], edi
je 0x44a6b7
mov ecx, 0xa
call fcn.004700b0
jmp 0x44a6c0
call esi
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44a4fc
xor eax, eax
jmp 0x44a503
push 0x22
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44a56b
call esi
mov edx, dword [0x49ab6c]
cmp eax, dword [edx + 0x10]
je 0x44a51b
xor eax, eax
jmp 0x44a522
push 0x28
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44a56b
call esi
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44a53a
xor eax, eax
jmp 0x44a541
push 0x21
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44a56b
call esi
mov edx, dword [0x49ab6c]
cmp eax, dword [edx + 0x10]
je 0x44a559
xor eax, eax
jmp 0x44a560
push 0x26
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44a56b
mov dword [esp + 0x5c], edi
call esi
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44a57c
xor eax, eax
jmp 0x44a583
push 0x22
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44a5a9
call esi
mov edx, dword [0x49ab6c]
cmp eax, dword [edx + 0x10]
je 0x44a59b
xor eax, eax
jmp 0x44a5a2
push 0x28
call ebx
movzx eax, ax
test eax, 0x8000
je 0x44a5c8
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [esp + 0x5c]
add ecx, 0x7d
cmp eax, ecx
ja 0x44a665
cmp eax, dword [esp + 0x5c]
jb 0x44a665
call esi
mov edx, dword [0x49ab6c]
cmp eax, dword [edx + 0x10]
je 0x44a5d9
xor eax, eax
jmp 0x44a5e0
push 0x21
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44a606
call esi
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44a5f8
xor eax, eax
jmp 0x44a5ff
push 0x26
call ebx
movzx eax, ax
test eax, 0x8000
je 0x44a670
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [esp + 0x5c]
add edx, 0x7d
cmp eax, edx
ja 0x44a61d
cmp eax, dword [esp + 0x5c]
jae 0x44a670
mov eax, dword [esp + 0x28]
cmp dword [0x591610], eax
jl 0x44a670
mov dword [esp + 0x24], eax
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp byte [0x52e3b0], 0
mov dword [esp + 0x5c], eax
je 0x44a89c
push edi
push 0x52e3b0
cmp dword [0x653778], edi
je 0x44a893
mov ecx, 0xa
call fcn.004700b0
jmp 0x44a89c
cmp dword [esp + 0x24], 1
jg 0x44aa71
cmp dword [0x58faec], edi
jne 0x44aa84
cmp dword [0x58faf0], edi
jne 0x44ae86
call esi
mov ecx, dword [0x49ab6c]
cmp eax, dword [ecx + 0x10]
je 0x44a699
xor eax, eax
jmp 0x44a6a0
push 0x1b
call ebx
movzx eax, ax
test eax, 0x8000
jne 0x44ae80
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x449e60
mov ecx, dword [esp + 0x20]
call fcn.00471890
mov eax, dword [esp + 0x33c]
cmp eax, edi
je 0x44a700
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x378], edi
je 0x44a700
mov edx, dword [esp + 0x384]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x378]
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x3b0]
mov ebx, 1
lea esi, [ebx + 2]
mov byte [esp + 0x124], 0
mov dword [esp + 0x3b4], edi
mov dword [esp + 0x3ac], edi
mov dword [esp + 0x3a8], ebx
mov dword [esp + 0x3a4], edi
mov dword [esp + 0x39c], esi
mov dword [esp + 0x3a0], 0xffffffff
mov dword [esp + 0x33c], edi
mov dword [esp + 0x324], edi
mov dword [esp + 0x328], ebx
mov dword [esp + 0x398], edi
cmp eax, edi
je 0x44a775
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x3b0], edi
cmp dword [esp + 0x378], edi
je 0x44a7a3
mov ecx, dword [esp + 0x384]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x378]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x5d4]
cmp eax, edi
je 0x44a7e3
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x610], edi
je 0x44a7e3
mov eax, dword [esp + 0x61c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x610]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, dword [esp + 0x648]
mov byte [esp + 0x3bc], 0
mov dword [esp + 0x64c], edi
mov dword [esp + 0x644], edi
mov dword [esp + 0x640], ebx
mov dword [esp + 0x63c], edi
mov dword [esp + 0x634], esi
mov dword [esp + 0x638], 0xffffffff
mov dword [esp + 0x5d4], edi
mov dword [esp + 0x5bc], edi
mov dword [esp + 0x5c0], ebx
mov dword [esp + 0x630], edi
cmp eax, edi
je 0x44a850
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x648], edi
cmp dword [esp + 0x610], edi
je 0x44a87e
mov edx, dword [esp + 0x61c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x610]
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x74]
push ecx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x448354
mov ecx, dword [esp + 0x20]
call fcn.00471890
mov eax, dword [esp + 0x33c]
cmp eax, edi
je 0x44a8dc
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x378], edi
je 0x44a8dc
mov ecx, dword [esp + 0x384]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x378]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x3b0]
mov ebx, 1
mov esi, 3
mov dword [esp + 0x398], edi
mov dword [esp + 0x328], ebx
mov dword [esp + 0x324], edi
mov dword [esp + 0x33c], edi
mov dword [esp + 0x3a0], 0xffffffff
mov dword [esp + 0x39c], esi
mov dword [esp + 0x3a4], edi
mov dword [esp + 0x3a8], ebx
mov dword [esp + 0x3ac], edi
mov dword [esp + 0x3b4], edi
mov byte [esp + 0x124], 0
cmp eax, edi
je 0x44a953
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x3b0], edi
cmp dword [esp + 0x378], edi
je 0x44a981
mov eax, dword [esp + 0x384]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x378]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x5d4]
cmp eax, edi
je 0x44a9c1
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x610], edi
je 0x44a9c1
mov edx, dword [esp + 0x61c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x610]
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, dword [esp + 0x648]
mov dword [esp + 0x630], edi
mov dword [esp + 0x5c0], ebx
mov dword [esp + 0x5bc], edi
mov dword [esp + 0x5d4], edi
mov dword [esp + 0x638], 0xffffffff
mov dword [esp + 0x634], esi
mov dword [esp + 0x63c], edi
mov dword [esp + 0x640], ebx
mov dword [esp + 0x644], edi
mov dword [esp + 0x64c], edi
mov byte [esp + 0x3bc], 0
cmp eax, edi
je 0x44aa2e
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x648], edi
cmp dword [esp + 0x610], edi
je 0x44aa5c
mov ecx, dword [esp + 0x61c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x610]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x448354
dec dword [esp + 0x24]
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [esp + 0x5c], eax
jmp 0x44a4bd
mov eax, dword [esp + 0x20]
mov dword [0x58faec], edi
cmp eax, edi
je 0x44ae78
add dword [esp + 0x24], eax
cmp byte [0x52e3b0], 0
je 0x44aac6
push edi
push 0x52e3b0
cmp dword [0x653778], edi
je 0x44aabd
mov ecx, 0xa
call fcn.004700b0
jmp 0x44aac6
mov ecx, dword [esp + 0x20]
call fcn.00471890
mov eax, dword [esp + 0x33c]
cmp eax, edi
je 0x44ab06
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x378], edi
je 0x44ab06
mov eax, dword [esp + 0x384]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x378]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x3b0]
mov ebx, 1
mov esi, 3
mov dword [esp + 0x398], edi
mov dword [esp + 0x328], ebx
mov dword [esp + 0x324], edi
mov dword [esp + 0x33c], edi
mov dword [esp + 0x3a0], 0xffffffff
mov dword [esp + 0x39c], esi
mov dword [esp + 0x3a4], edi
mov dword [esp + 0x3a8], ebx
mov dword [esp + 0x3ac], edi
mov dword [esp + 0x3b4], edi
mov byte [esp + 0x124], 0
cmp eax, edi
je 0x44ab7d
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x3b0], edi
cmp dword [esp + 0x378], edi
je 0x44abab
mov edx, dword [esp + 0x384]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x378]
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x5d4]
cmp eax, edi
je 0x44abeb
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x610], edi
je 0x44abeb
mov ecx, dword [esp + 0x61c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x610]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, dword [esp + 0x648]
mov dword [esp + 0x630], edi
mov dword [esp + 0x5c0], ebx
mov dword [esp + 0x5bc], edi
mov dword [esp + 0x5d4], edi
mov dword [esp + 0x638], 0xffffffff
mov dword [esp + 0x634], esi
mov dword [esp + 0x63c], edi
mov dword [esp + 0x640], ebx
mov dword [esp + 0x644], edi
mov dword [esp + 0x64c], edi
mov byte [esp + 0x3bc], 0
cmp eax, edi
je 0x44ac58
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x648], edi
cmp dword [esp + 0x610], edi
je 0x44ac86
mov eax, dword [esp + 0x61c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x610]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x74]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x448354
mov eax, dword [esp + 0x33c]
cmp eax, edi
je 0x44acdb
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x378], edi
je 0x44acdb
mov ecx, dword [esp + 0x384]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x378]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x3b0]
mov esi, 1
mov ebx, 3
mov dword [esp + 0x398], edi
mov dword [esp + 0x328], esi
mov dword [esp + 0x324], edi
mov dword [esp + 0x33c], edi
mov dword [esp + 0x3a0], 0xffffffff
mov dword [esp + 0x39c], ebx
mov dword [esp + 0x3a4], edi
mov dword [esp + 0x3a8], esi
mov dword [esp + 0x3ac], edi
mov dword [esp + 0x3b4], edi
mov byte [esp + 0x124], 0
cmp eax, edi
je 0x44ad52
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x3b0], edi
cmp dword [esp + 0x378], edi
je 0x44ad80
mov eax, dword [esp + 0x384]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x378]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x5d4]
cmp eax, edi
je 0x44adc0
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x610], edi
je 0x44adc0
mov edx, dword [esp + 0x61c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x610]
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, dword [esp + 0x648]
mov dword [esp + 0x630], edi
mov dword [esp + 0x5c0], esi
mov dword [esp + 0x5bc], edi
mov dword [esp + 0x5d4], edi
mov dword [esp + 0x638], 0xffffffff
mov dword [esp + 0x634], ebx
mov dword [esp + 0x63c], edi
mov dword [esp + 0x640], esi
mov dword [esp + 0x644], edi
mov dword [esp + 0x64c], edi
mov byte [esp + 0x3bc], 0
cmp eax, edi
je 0x44ae2d
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x648], edi
cmp dword [esp + 0x610], edi
je 0x44ae5b
mov ecx, dword [esp + 0x61c]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x610]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [0x58fb7c], edi
xor eax, eax
jmp 0x44b152
mov dword [0x58faec], edi
jmp 0x44aeb4
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call esi
mov edx, dword [0x49ab6c]
cmp eax, dword [edx + 0x10]
je 0x44ae97
xor eax, eax
jmp 0x44ae9e
push 0x1b
call ebx
movzx eax, ax
test eax, 0x8000
je 0x44aeae
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44ae86
mov dword [0x58faf0], edi
mov eax, dword [esp + 0x33c]
cmp eax, edi
je 0x44aef4
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x378], edi
je 0x44aef4
mov eax, dword [esp + 0x384]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x378]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, 1
mov dword [esp + 0x328], eax
mov dword [esp + 0x3a8], eax
mov eax, dword [esp + 0x3b0]
mov esi, 3
mov dword [esp + 0x398], edi
mov dword [esp + 0x324], edi
mov dword [esp + 0x33c], edi
mov dword [esp + 0x3a0], 0xffffffff
mov dword [esp + 0x39c], esi
mov dword [esp + 0x3a4], edi
mov dword [esp + 0x3ac], edi
mov dword [esp + 0x3b4], edi
mov byte [esp + 0x124], 0
cmp eax, edi
je 0x44af6b
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x3b0], edi
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [esp + 0x378], edi
je 0x44af9b
mov edx, dword [esp + 0x384]
push edx
call ebx
mov eax, dword [esp + 0x378]
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x378], edi
mov eax, dword [esp + 0x5d4]
cmp eax, edi
je 0x44afd7
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [esp + 0x610], edi
je 0x44afd7
mov ecx, dword [esp + 0x61c]
push ecx
call ebx
mov edx, dword [esp + 0x610]
push edx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov eax, 1
mov dword [esp + 0x5c0], eax
mov dword [esp + 0x640], eax
mov eax, dword [esp + 0x648]
mov dword [esp + 0x630], edi
mov dword [esp + 0x5bc], edi
mov dword [esp + 0x5d4], edi
mov dword [esp + 0x638], 0xffffffff
mov dword [esp + 0x634], esi
mov dword [esp + 0x63c], edi
mov dword [esp + 0x644], edi
mov dword [esp + 0x64c], edi
mov byte [esp + 0x3bc], 0
cmp eax, edi
je 0x44b049
push eax
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x648], edi
cmp dword [esp + 0x610], edi
je 0x44b073
mov eax, dword [esp + 0x61c]
push eax
call ebx
mov ecx, dword [esp + 0x610]
push ecx
call fcn.00407f4f
add esp, 4
mov dword [esp + 0x610], edi
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x74]
push edx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [esp + 0x1390], 0xffffffff
cmp dword [0x53b590], 1
mov dword [0x58fb7c], edi
jne 0x44b0fe
cmp dword [0x496800], edi
je 0x44b0fe
mov ecx, dword [0x53c458]
mov edx, dword [0x53b594]
mov ebx, dword [0x4edba0]
push ecx
mov ecx, dword [0x544434]
mov dword [0x49b484], edi
mov dword [0x53b590], edi
call fcn.0044e920
add esp, 4
mov eax, 0x53b798
call fcn.004566d0
mov edx, dword [0x4ed874]
mov eax, dword [0x52dc0c]
mov ecx, dword [esp + 0x18]
push 0x53b798
push edx
push eax
mov edx, 0x544438
call fcn.0045f070
xor edi, edi
mov dword [0x49b484], 1
cmp dword [0x58fe14], edi
je 0x44b12a
mov ecx, dword [0x54a9dc]
mov edx, dword [0x54acf8]
mov dword [ecx*4 + 0x53a1c8], edi
mov dword [edx*4 + 0x53a1c8], edi
xor eax, eax
call fcn.004566d0
mov eax, dword [0x4ed874]
mov ecx, dword [0x52dc0c]
push edi
push eax
push ecx
mov ecx, dword [esp + 0x24]
mov edx, 0x544438
call fcn.0045f070
mov eax, 1
mov ecx, dword [esp + 0x1388]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1370]
xor ecx, esp
call fcn.00407f40
mov esp, ebp
pop ebp
ret