Function at 0x417730
Capabilities:
Access peb ldr_data
Inspect section memory permissions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ced5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3c], edi
mov eax, dword [ebx + 0x14]
lea edx, [edi + 0x30]
mov ecx, dword [ebx + 8]
xor esi, esi
mov dword [ebp - 0xa0], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x88], edx
cmp dword [edi + 0x260], esi
je 0x4177cf
push esi
push esi
mov ecx, edx
call fcn.0040db40
lea ecx, [edi + 0x30]
call fcn.0040c540
mov ecx, dword [ebp - 0xa8]
lea edx, [edi + 0x30]
jmp 0x4177d5
mov dword [ebp - 0x88], edx
mov eax, dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x9c], eax
test ecx, ecx
je 0x417834
mov eax, dword [ecx + 0x1c0]
test eax, eax
mov dword [edi + 0x2c], eax
cmove eax, edx
mov dword [edx + 0x1c0], eax
mov esi, dword [ecx + 0x230]
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x90], esi
call dword [ebp - 0x9c]
test eax, 0x20000000
je 0x41781f
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x41783d
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x41783d
xor esi, esi
mov dword [ebp - 0x90], esi
jmp 0x41783d
mov eax, dword [edi + 0x1f0]
mov dword [edi + 0x2c], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0
cmp eax, 4
jne 0x418287
test esi, esi
je 0x418603
push 0xfffffffffffffff0
push esi
call dword [ebp - 0x9c]
test eax, 0x20000000
jne 0x418603
mov ecx, 0xc8
lea eax, [ebp - 0x84]
cmp dword [ebp - 0xa4], ecx
push eax
cmovge ecx, dword [ebp - 0xa4]
cmp dword [ebp - 0xa0], 0x46
mov dword [ebp - 0xb0], ecx
mov ecx, 0x4b
cmovge ecx, dword [ebp - 0xa0]
push esi
mov dword [ebp - 0x98], ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4178e5
lea eax, [ebp - 0x4c]
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x4c], xmm0
call dword [sym.imp.USER32.dll_GetWindowRgnBox]
test eax, eax
je 0x4178e5
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x48]
add edx, dword [ebp - 0x4c]
add eax, 4
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x80], eax
jmp 0x4178ee
mov eax, dword [ebp - 0x80]
mov edx, dword [ebp - 0x84]
xorps xmm0, xmm0
lea ecx, [edx + 0x18]
movups xmmword [ebp - 0x54], xmm0
add eax, 0x10
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0xa4], eax
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x40], 1
push 1
push 0x4c02bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
push dword [ebp - 0x8c]
call fcn.004032c0
xorps xmm0, xmm0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x74]
movq qword [ebp - 0x64], xmm0
movups xmmword [ebp - 0x74], xmm0
call fcn.004031d0
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa0], eax
cmp esi, 1
jbe 0x4179ab
test esi, esi
jne 0x41798f
mov dword [ebp - 0xb8], esi
jmp 0x4179b5
cmp esi, 1
ja 0x4179a0
mov eax, dword [eax + esi*4 - 4]
mov dword [ebp - 0xb8], eax
jmp 0x4179b5
mov eax, dword [eax + 4]
mov dword [ebp - 0xb8], eax
jmp 0x4179b5
mov dword [ebp - 0xb8], 0x4c02c4
push 0xffffffffffffffec
push dword [ebp - 0x90]
call dword [ebp - 0x9c]
push ecx
push dword [ebp - 0x90]
and eax, 8
lea ecx, [edi + 0x30]
push eax
push SysReAllocString
push dword [ebp - 0xa4]
push dword [ebp - 0x88]
push dword [ebp - 0x98]
push dword [ebp - 0xb0]
push dword [ebp - 0xb8]
push 0x4c02dc
call fcn.0040bf80
mov ecx, dword [ebp - 0xa8]
mov dword [ebp - 0xb4], eax
xor eax, eax
add ecx, 0x50
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x90], ecx
nop dword [eax + eax]
mov ecx, dword [ecx]
test ecx, ecx
je 0x417a54
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov eax, dword [ebp - 0x9c]
je 0x417a54
mov ecx, dword [ebp - 0x90]
inc eax
add ecx, 4
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x90], ecx
cmp eax, 0x30
jl 0x417a20
jmp 0x417a6d
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xb4]
mov dword [ecx + eax*4 + 0x50], edx
inc eax
cmp eax, dword [ecx + 0x4c]
jle 0x417a6d
mov dword [ecx + 0x4c], eax
movsd xmm0, qword [0x4cc768]
xor eax, eax
movsd qword [edi + 0x1a0], xmm0
mov dword [edi + 0x1a8], 0x190
mov byte [edi + 0x1ac], 1
mov byte [edi + 0x1ee], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x417aa0
inc eax
push eax
push 0x4bff50
lea eax, [edi + 0x1ae]
push 0x20
push eax
call fcn.0048cf13
add esp, 0x10
mov dword [edi + 0x254], 0xffffff
mov eax, 1
test esi, esi
jne 0x417adf
mov dword [ebp - 0x9c], esi
jmp 0x417af3
cmove esi, eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x54], esi
mov eax, dword [eax]
mov dword [ebp - 0x9c], eax
lea ecx, [edi + 0x30]
call fcn.00416d40
test al, al
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xa4], eax
jne 0x417b1f
mov eax, dword [edi + 0x260]
mov dword [ebp - 0xa8], 0
jmp 0x417c0e
mov eax, dword [edi + 0x70]
push 0
push dword [edi + 0x14c]
inc eax
push eax
push dword [edi + 0x264]
mov eax, dword [ebp - 0x98]
add eax, 0xffffffd3
push eax
mov eax, dword [ebp - 0xb0]
add eax, 0xffffffec
push eax
movzx eax, byte [edi + 0x278]
push 0x23
and eax, 1
push 0xa
shl eax, 0x11
add eax, 0x50000100
push eax
push dword [ebp - 0x9c]
push 0x4c018c
push 0
call dword [ebp - 0xa4]
test eax, eax
jne 0x417b85
mov dword [ebp - 0xa8], eax
mov eax, dword [edi + 0x260]
jmp 0x417c0e
push eax
push 0xd
lea ecx, [edi + 0x30]
call fcn.00416ab0
mov ecx, dword [edi + 0x6c]
mov dword [ebp - 0xa8], eax
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0xb0]
mov dword [ecx + edx*8 + 0x24], 0xa
add eax, 0xffffffec
mov dword [ecx + edx*8 + 0x28], 0x23
mov dword [ecx + edx*8 + 0x2c], eax
mov eax, dword [ebp - 0x98]
add eax, 0xffffffd3
mov dword [ecx + edx*8 + 0x30], eax
mov edx, dword [ebp - 0xa8]
mov eax, edx
mov edi, dword [ebp - 0x3c]
test edx, edx
jne 0x417bdd
mov eax, dword [edi + 0x260]
jmp 0x417c0e
cmp edx, 0xffffffff
jne 0x417be5
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x6c]
test ecx, ecx
je 0x417c06
cmp eax, 1
jl 0x417c06
cmp eax, dword [edi + 0x70]
jg 0x417c06
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x417c06
mov eax, dword [ecx + eax*8 + 4]
jmp 0x417c08
xor eax, eax
mov dword [ebp - 0xa8], edx
push eax
mov dword [ebp - 0x9c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
test esi, esi
jne 0x417c37
xor ecx, ecx
jmp 0x417c4a
mov eax, 1
cmove esi, eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x54], esi
mov ecx, dword [eax]
push 1
push 0x4c013c
push ecx
lea ecx, [ebp - 0x74]
call fcn.004032c0
mov ecx, dword [ebp - 0x74]
mov edx, 0x10
xor esi, esi
mov dword [ebp - 0xb0], 0x4b
mov dword [ebp - 0x90], edx
test ecx, ecx
je 0x417d05
lea edi, [edx + 0x3b]
nop
test ecx, ecx
je 0x417caa
mov eax, dword [ebp - 0x6c]
cmp esi, ecx
jb 0x417c91
mov edx, dword [eax + ecx*4 - 4]
jmp 0x417c94
mov edx, dword [eax + esi*4]
test edx, edx
je 0x417caa
xor eax, eax
cmp word [edx], ax
je 0x417cac
nop
inc eax
cmp word [edx + eax*2], 0
jne 0x417ca0
jmp 0x417cac
xor eax, eax
test ecx, ecx
je 0x417cc0
mov edx, dword [ebp - 0x6c]
cmp esi, ecx
jb 0x417cbd
mov ecx, dword [edx + ecx*4 - 4]
jmp 0x417cc0
mov ecx, dword [edx + esi*4]
lea edx, [ebp - 0x5c]
push edx
push eax
push ecx
push dword [ebp - 0x8c]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov edx, dword [ebp - 0x90]
test eax, eax
je 0x417cf4
mov eax, dword [ebp - 0x5c]
add eax, 0x14
cmp eax, edi
cmovg edi, eax
cmp dword [ebp - 0x58], edx
cmovg edx, dword [ebp - 0x58]
mov dword [ebp - 0x90], edx
mov ecx, dword [ebp - 0x74]
inc esi
cmp esi, ecx
jb 0x417c80
mov dword [ebp - 0xb0], edi
mov edi, dword [ebp - 0x3c]
push dword [ebp - 0x8c]
imul edx, ecx
push dword [ebp - 0x9c]
mov dword [ebp - 0x90], edx
lea esi, [edx + 0x2d]
mov dword [ebp - 0x98], esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x212
push esi
push dword [ebp - 0xb0]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 0
push 0
push dword [ebp - 0xb4]
call esi
mov eax, dword [ebp - 0xb0]
push 0x202
push dword [ebp - 0x90]
add eax, 0xffffffec
push eax
push 0
push 0
push 0
push dword [ebp - 0x9c]
call esi
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x88], eax
test esi, esi
je 0x417dc6
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], 0
push eax
push 0
push 0xe200b
push 0
push dword [ebp - 0x98]
xorps xmm0, xmm0
push dword [ebp - 0xb0]
movups xmmword [esi], xmm0
mov dword [esi], vtable.Gdiplus::Bitmap.0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x8c]
mov dword [esi + 4], eax
jmp 0x417dce
xor esi, esi
mov dword [ebp - 0x88], esi
mov eax, dword [esi + 8]
mov dword [esi + 8], 0
test eax, eax
jne 0x417f0c
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov edi, dword [ebp - 0x8c]
lea eax, [ebp - 0x90]
push eax
push 0xff000000
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x90], 0
call dword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
push dword [ebp - 0x98]
mov esi, dword [ebp - 0x90]
push dword [ebp - 0xb0]
push 0
push 0
push esi
push edi
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
mov edi, dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
push esi
call edi
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0
push eax
push 0
push ecx
mov dword [esp], 0x40000000
push 0xffffffffffffffff
call dword [sym.imp.gdiplus.dll_GdipCreatePen1]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x98]
add eax, 0xfffffffe
push eax
mov eax, dword [ebp - 0xb0]
add eax, 0xfffffffe
push eax
push 1
push 1
push dword [ebp - 0x94]
push dword [ebp - 0x9c]
call dword [sym.imp.gdiplus.dll_GdipDrawRectangleI]
push dword [ebp - 0x94]
call dword [sym.imp.gdiplus.dll_GdipDeletePen]
movaps xmm0, xmmword [0x4ccf10]
lea eax, [ebp - 0x98]
push eax
push 0xff6060ff
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x20
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x98], 0
call dword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
mov esi, dword [ebp - 0x98]
lea eax, [ebp - 0x38]
push 0
push 3
push eax
push esi
push dword [ebp - 0x9c]
call dword [sym.imp.gdiplus.dll_GdipFillPolygonI]
push esi
call edi
push dword [ebp - 0x9c]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x88]
cmp dword [edi + 0x218], 0
je 0x4180ec
mov eax, dword [edi + 0x210]
test eax, eax
je 0x417f2a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [ebp - 0x88]
mov dword [edi + 0x210], 0
push eax
push dword [esi + 4]
mov dword [ebp - 0x88], 0
call dword [sym.imp.gdiplus.dll_GdipGetImageWidth]
test eax, eax
je 0x417f55
mov dword [esi + 8], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipGetImageHeight]
test eax, eax
je 0x417f70
mov dword [esi + 8], eax
lea eax, [edi + 0x150]
push eax
push dword [edi + 0x260]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [edi + 0x158]
cmp edx, 0xffffffff
mov ecx, dword [edi + 0x15c]
cmove edx, dword [ebp - 0x88]
cmp ecx, 0xffffffff
mov dword [ebp - 0x98], edx
cmove ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x8c], ecx
cmp dword [ebp - 0x88], edx
jne 0x417fcb
cmp dword [ebp - 0x3c], ecx
jne 0x417fcb
mov byte [ebp - 0xa9], 0
mov dword [ebp - 0x90], esi
jmp 0x41804d
push 0x10
mov byte [ebp - 0xa9], 1
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov dword [ebp - 0x90], eax
test eax, eax
je 0x418030
xorps xmm0, xmm0
mov dword [ebp - 0x88], 0
movups xmmword [eax], xmm0
mov dword [eax], vtable.Gdiplus::Bitmap.0
lea eax, [ebp - 0x88]
push eax
push 0
push 0xe200b
push 0
push dword [ebp - 0x8c]
push dword [ebp - 0x98]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov ecx, dword [ebp - 0x90]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [ecx + 4], eax
jmp 0x418038
xor ecx, ecx
mov dword [ebp - 0x90], ecx
push dword [ebp - 0x8c]
mov edx, ecx
mov ecx, esi
push dword [ebp - 0x98]
call fcn.00405330
push 0xfefefe
lea eax, [edi + 0x210]
push eax
mov eax, dword [ebp - 0x90]
push dword [eax + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
mov ecx, eax
test ecx, ecx
je 0x418077
mov eax, dword [ebp - 0x90]
mov dword [eax + 8], ecx
mov eax, dword [edi + 0x22c]
test eax, eax
je 0x418091
cmp dword [edi + 0x234], 4
je 0x418091
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [edi + 0x210]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push dword [edi + 0x210]
mov dword [edi + 0x22c], eax
push dword [edi + 0x218]
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x214], 0
jne 0x4180c6
mov dword [edi + 0x214], eax
jmp 0x4180cd
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp byte [ebp - 0xa9], 0
mov dword [edi + 0x234], 1
je 0x4180ec
mov ecx, dword [ebp - 0x90]
push 1
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov eax, dword [ebp - 0xb0]
lea ecx, [edi + 0x30]
add eax, 0xffffffdd
mov dword [ebp - 0x88], eax
call fcn.00416d40
test al, al
jne 0x418116
xor esi, esi
jmp 0x4181a2
mov eax, dword [edi + 0x70]
push 0
push dword [edi + 0x14c]
inc eax
push eax
push dword [edi + 0x264]
movzx eax, byte [edi + 0x278]
push 0x14
push dword [ebp - 0x88]
and eax, 1
push 6
push 0x23
shl eax, 0x11
add eax, 0x50000100
push eax
push dword [ebp - 0xb8]
push 0x4c018c
push 0
call dword [ebp - 0xa4]
test eax, eax
jne 0x418163
xor esi, esi
jmp 0x4181a2
push eax
push 0xd
lea ecx, [edi + 0x30]
call fcn.00416ab0
mov ecx, dword [edi + 0x6c]
mov dword [ebp - 0xa4], eax
mov esi, dword [ebp - 0xa4]
lea edx, [eax + eax*8]
mov dword [ecx + edx*8 + 0x24], 0x23
mov dword [ecx + edx*8 + 0x28], 6
mov eax, dword [ebp - 0x88]
mov dword [ecx + edx*8 + 0x2c], eax
mov dword [ecx + edx*8 + 0x30], 0x14
movsd xmm0, qword [0x4cc780]
sub esp, 0x14
movsd qword [esp + 0xc], xmm0
push 0x190
push ecx
lea ecx, [edi + 0x30]
call fcn.00413b20
mov eax, 0x1b
mov byte [ebp - 0x20], 1
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 0xa8]
mov word [ebp - 0x1c], ax
mov eax, 0xd
mov word [ebp - 0x18], ax
mov eax, dword [edi + 0x274]
mov byte [ebp - 0x1a], 1
mov word [ebp - 0x16], si
test eax, eax
je 0x4181fa
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push 2
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
mov dword [edi + 0x274], eax
cmp eax, 0xffffffff
jne 0x41821b
mov dword [edi + 0x274], 0
push 1
push 4
lea ecx, [edi + 0x30]
call fcn.0040db40
mov eax, dword [ebp - 0xb4]
push edi
push eax
push 0x40b6e0
push eax
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x41824b
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x41825b
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41826b
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x418603
push eax
call fcn.00489c73
add esp, 4
jmp 0x418603
mov ecx, dword [ebp - 0xa4]
mov eax, 0x168
push ecx
push esi
push 0xffffffffffffffff
push SysReAllocString
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0xa0]
cmp ecx, 0xa0
cmovge eax, ecx
mov ecx, dword [ebp - 0x88]
push eax
push 0x4bfbd0
push 0x4c02fc
mov dword [ebp - 0xb4], eax
call fcn.0040bf80
movsd xmm0, qword [0x4cc768]
xor eax, eax
movsd qword [edi + 0x1a0], xmm0
mov dword [edi + 0x1a8], 0x190
mov byte [edi + 0x1ac], 1
mov byte [edi + 0x1ee], 0
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x4182f4
inc eax
push eax
push 0x4bff50
lea eax, [edi + 0x1ae]
push 0x20
push eax
call fcn.0048cf13
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x30]
add esp, 0xc
mov dword [edi + 0x254], eax
push dword [edi + 0x28]
push dword [edi + 0x20]
push dword [edi + 0x1c]
push dword [edi + 0x18]
push dword [ebp - 0xa0]
push dword [ebp - 0xb4]
call fcn.004167f0
mov eax, dword [edi + 0x260]
mov edx, esi
push ecx
mov ecx, eax
mov dword [ebp - 0x88], eax
call fcn.004048d0
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x4183b1
lea eax, [ecx + 0x50]
xor esi, esi
mov dword [ebp - 0xa4], eax
nop dword [eax]
mov eax, dword [eax]
test eax, eax
je 0x418398
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x418398
mov eax, dword [ebp - 0xa4]
inc esi
add eax, 4
mov dword [ebp - 0xa4], eax
cmp esi, 0x30
jl 0x418370
jmp 0x4183b1
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x88]
mov dword [ecx + esi*4 + 0x50], eax
inc esi
cmp esi, dword [ecx + 0x4c]
jle 0x4183b1
mov dword [ecx + 0x4c], esi
mov eax, dword [ebp - 0xa0]
lea ecx, [edi + 0x30]
add eax, 0xffffffbf
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0xb4]
add eax, 0xffffffd8
mov dword [ebp - 0xa4], eax
call fcn.00416d40
test al, al
jne 0x4183e2
xor eax, eax
jmp 0x418464
mov eax, dword [edi + 0x70]
push 0
push dword [edi + 0x14c]
inc eax
push eax
push dword [edi + 0x264]
movzx eax, byte [edi + 0x278]
push dword [ebp - 0x88]
and eax, 1
push dword [ebp - 0xa4]
shl eax, 0x11
push 0x14
push 0x14
add eax, 0x50000100
push eax
push dword [ebp - 0x8c]
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x418464
push eax
push 0xd
lea ecx, [edi + 0x30]
call fcn.00416ab0
mov ecx, dword [edi + 0x6c]
mov esi, dword [ebp - 0xa4]
lea edx, [eax + eax*8]
mov dword [ecx + edx*8 + 0x24], 0x14
mov dword [ecx + edx*8 + 0x28], 0x14
mov dword [ecx + edx*8 + 0x2c], esi
mov esi, dword [ebp - 0x88]
mov dword [ecx + edx*8 + 0x30], esi
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0xb4]
add ecx, 0xffffffdd
mov dword [edi], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xa0], ecx
lea esi, [edx - 0x87]
cmp eax, 1
je 0x4184a8
cmp eax, 2
je 0x4184a8
cmp eax, 3
jne 0x4184c5
lea eax, [edx - 0xf0]
cdq
and edx, 3
lea esi, [edx + eax]
sar esi, 2
jmp 0x418582
lea ecx, [edx - 0xa0]
mov eax, 0x55555556
imul ecx
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebp - 0xa0]
mov esi, edx
shr esi, 0x1f
add esi, edx
test eax, eax
jne 0x4184ea
push ecx
push 0x10000001
push 0x19
push 0x50
push ecx
push esi
push 0x4c0324
lea ecx, [edi + 0x30]
call fcn.004116e0
mov dword [edi + 4], eax
jmp 0x4185e7
cmp eax, 1
jne 0x418535
push ecx
push 0x10000001
push 0x19
push 0x50
push ecx
push esi
push 0x4c032c
lea ecx, [edi + 0x30]
call fcn.004116e0
push ecx
push 0xffffffffffffffff
push 0x19
push 0x50
push dword [ebp - 0xa0]
mov dword [edi + 4], eax
lea ecx, [edi + 0x30]
lea eax, [esi*2 + 0x50]
push eax
push 0x4c0334
call fcn.004116e0
mov dword [edi + 8], eax
jmp 0x4185e7
cmp eax, 2
jne 0x41857d
push ecx
push 0x10000001
push 0x19
push 0x50
push ecx
push esi
push 0x4c0324
lea ecx, [edi + 0x30]
call fcn.004116e0
push ecx
push 0xffffffffffffffff
push 0x19
push 0x50
push dword [ebp - 0xa0]
mov dword [edi + 4], eax
lea ecx, [edi + 0x30]
lea eax, [esi*2 + 0x50]
push eax
push 0x4c033c
call fcn.004116e0
mov dword [edi + 8], eax
jmp 0x4185e7
cmp eax, 3
jne 0x4185e7
push ecx
push 0x10000001
push 0x19
push 0x50
push ecx
push esi
push 0x4c032c
lea ecx, [edi + 0x30]
call fcn.004116e0
push ecx
push 0xffffffffffffffff
push 0x19
push 0x50
push dword [ebp - 0xa0]
mov dword [edi + 4], eax
lea ecx, [edi + 0x30]
lea eax, [esi*2 + 0x50]
push eax
push 0x4c0334
call fcn.004116e0
push ecx
push 0xffffffffffffffff
push 0x19
push 0x50
push dword [ebp - 0xa0]
mov dword [edi + 8], eax
lea ecx, [edi + 0x30]
lea eax, [esi + 0x50]
lea eax, [esi + eax*2]
push eax
push 0x4c033c
call fcn.004116e0
mov dword [edi + 0xc], eax
push 7
push 5
lea ecx, [edi + 0x30]
call fcn.0040db40
push 0x80
push dword [edi + 4]
lea ecx, [edi + 0x30]
call fcn.00414360
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00489c65
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x20