Function at 0x46067e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, 0x4c3020
call fcn.0049d698
xor eax, eax
cmp dword [esi], 1
jne 0x461e8d
push 0x4cee90
call fcn.00499d42
pop ecx
cmp eax, dword [ebx + 0x3f]
je 0x4606f1
push 0x4cee90
call fcn.00499d42
pop ecx
mov dword [ebx + 0x3f], eax
mov edx, dword [ebx + 0x3f]
lea eax, [ebp - 0x104]
mov dword [ebp - 0x100], edx
lea edx, [ebp - 0xfc]
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0x104], ecx
push eax
push dword [ebx + 0x23]
push edx
call fcn.0047867f
add esp, 0xc
mov eax, dword [esi + 0x10]
mov cl, 1
test al, 4
sete dl
and edx, 1
test al, 1
mov byte [ebp - 0x105], dl
jne 0x460709
dec ecx
mov byte [ebp - 0x106], cl
mov dl, 1
test al, 8
jne 0x460716
dec edx
mov byte [ebp - 0x107], dl
xor eax, eax
mov byte [ebp - 0x10a], al
mov byte [ebp - 0x109], al
mov byte [ebp - 0x108], al
mov edx, dword [esi + 0x2c]
mov dword [ebp - 0x110], edx
cmp dword [ebp - 0x110], 0
je 0x461e8b
push 0x11
lea ecx, [ebp - 0x254]
push ecx
call fcn.0047a52c
add esp, 8
mov eax, dword [ebp - 0x110]
cmp dword [eax + 8], 0
jl 0x4607aa
lea edx, [ebp - 0x254]
push edx
push 0
push dword [esi + 8]
push dword [esi + 0x14]
call sub.USER32.dll_GetMenuItemInfoA
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 0x108], cl
cmp cl, 1
jne 0x4607aa
test byte [ebp - 0x247], 0x10
je 0x46079a
mov byte [ebp - 0x109], 1
test byte [ebp - 0x24b], 2
je 0x4607aa
mov byte [ebp - 0x10a], 1
mov word [ebp - 0xe0], 8
push dword [esi + 0x18]
lea eax, [ebp - 0x20]
push eax
call fcn.0046b025
inc dword [ebp - 0xd4]
xor edx, edx
mov word [ebp - 0xe0], 0x14
mov dword [ebp - 0x114], edx
add esp, 8
cmp dword [ebx + 0x3b], 0
jne 0x4608bf
mov eax, 0x154
lea edx, [ebp - 0x3a8]
mov dword [ebp - 0x3a8], eax
push 0
push edx
push dword [ebp - 0x3a8]
push 0x29
call sub.USER32.dll_SystemParametersInfoA
test eax, eax
je 0x460867
cmp byte [ebp - 0x108], 0
je 0x460824
cmp byte [ebp - 0x109], 0
je 0x460824
mov dword [ebp - 0x2f8], 0x2bc
push 5
call fcn.004a78c0
pop ecx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x46085c
mov word [ebp - 0xe0], 0x2c
lea edx, [ebp - 0x308]
push edx
push dword [ebp - 0x24]
call fcn.00472926
add esp, 8
mov word [ebp - 0xe0], 0x20
mov ecx, dword [ebp - 0x24]
jmp 0x46085f
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x114], ecx
jmp 0x4608ab
push 5
call fcn.004a78c0
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
je 0x4608a2
mov word [ebp - 0xe0], 0x44
push 0
push 0x11
call sub.GDI32.dll_GetStockObject
push eax
push dword [ebp - 0x28]
call fcn.00472798
add esp, 0xc
mov word [ebp - 0xe0], 0x38
mov edx, dword [ebp - 0x28]
jmp 0x4608a5
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x114], edx
push dword [ebp - 0x114]
lea eax, [ebp - 0x20]
push eax
call fcn.0046b1b6
add esp, 8
jmp 0x4608ce
push dword [ebx + 0x3b]
lea ecx, [ebp - 0x20]
push ecx
call fcn.0046b1b6
add esp, 8
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 0x1b]
call dword [edx + 0x58]
pop ecx
cmp eax, dword [ebp - 0x20]
je 0x4608e8
push 1
push dword [ebp - 0x20]
call sub.GDI32.dll_SetBkMode
push 1
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [ebp - 0x1b]
call dword [eax + 0x58]
pop ecx
push eax
call sub.GDI32.dll_SetBkMode
mov dword [ebp - 0x118], eax
add esi, 0x1c
mov word [ebp - 0xe0], 0x14
mov dword [ebp - 0x11c], esi
lea edi, [ebp - 0x3b8]
mov eax, dword [ebp - 0x11c]
mov ecx, 4
mov esi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3b8]
lea edi, [ebp - 0x3c8]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3b8]
lea edi, [ebp - 0x3d8]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x3b4]
add eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3c0], eax
cmp byte [ebx + 0x20], 0
je 0x460c0c
cmp dword [ebx + 0x2f], 0
je 0x460c0c
cmp dword [ebx + 0x2f], 0
je 0x460c0c
push dword [ebx + 0x2f]
call fcn.00465efd
pop ecx
test eax, eax
jle 0x460c0c
push dword [ebx + 0x2f]
call fcn.00465f24
pop ecx
test eax, eax
jle 0x460c0c
mov word [ebp - 0xe0], 0x50
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0047a1d8
add esp, 8
add dword [ebp - 0xd4], 3
mov word [ebp - 0xe0], 0x5c
mov word [ebp - 0xe0], 0x68
push 0x4cee64
lea eax, [ebp - 0x54]
push eax
call fcn.00486b24
add esp, 8
lea ecx, [ebp - 0x3b8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
push dword [edx]
push ecx
push dword [ebp - 0x4c]
call sub.USER32.dll_FillRect
test eax, eax
setne al
and eax, 1
sub dword [ebp - 0xd4], 2
push 2
lea edx, [ebp - 0x54]
push edx
call fcn.00486d2f
add esp, 8
lea ecx, [ebp - 0x4c]
push dword [ebx + 0x2f]
push ecx
call fcn.0047a362
add esp, 8
mov word [ebp - 0xe0], 0x74
push 0x4cee64
lea eax, [ebp - 0x5c]
push eax
call fcn.00486b24
add esp, 8
lea ecx, [ebp - 0x3b8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x124], eax
mov edx, dword [ebp - 0x124]
push dword [edx]
push ecx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne al
and eax, 1
sub dword [ebp - 0xd4], 2
push 2
lea edx, [ebp - 0x5c]
push edx
call fcn.00486d2f
add esp, 8
push dword [ebx + 0x2f]
call fcn.00465efd
pop ecx
push eax
mov eax, dword [ebp - 0x3b8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x128], eax
mov word [ebp - 0xe0], 0x5c
push dword [ebx + 0x2f]
call fcn.00465efd
pop ecx
push eax
mov eax, dword [ebp - 0x3b0]
pop edx
mov ecx, edx
cdq
idiv ecx
inc eax
mov dword [ebp - 0x12c], eax
push dword [ebx + 0x2f]
call fcn.00465f24
pop ecx
push eax
mov eax, dword [ebp - 0x3b4]
pop edx
mov ecx, edx
cdq
idiv ecx
mov dword [ebp - 0x130], eax
push dword [ebx + 0x2f]
call fcn.00465f24
pop ecx
push eax
mov eax, dword [ebp - 0x3ac]
pop edx
mov ecx, edx
cdq
idiv ecx
inc eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x12c]
jge 0x460bf7
mov esi, dword [ebp - 0x130]
cmp esi, dword [ebp - 0x134]
jge 0x460bdf
push 0
push dword [ebx + 0x2f]
call fcn.00465f24
pop ecx
mov edi, eax
imul edi, esi
push dword [ebx + 0x2f]
call fcn.00465efd
imul dword [ebp - 0x138]
pop ecx
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x144]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], edi
push edx
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0046b78c
add esp, 0xc
lea edi, [ebp - 0x3b8]
push 0xcc0020
push dword [edi + 4]
push dword [edi]
push dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x3b4]
push eax
mov edx, dword [ebp - 0x3b0]
sub edx, dword [ebp - 0x3b8]
push edx
push dword [ebp - 0x3b4]
push dword [ebp - 0x3b8]
push dword [ebp - 0x20]
call sub.GDI32.dll_BitBlt
test eax, eax
setne cl
and ecx, 1
inc esi
cmp esi, dword [ebp - 0x134]
jl 0x460b3f
inc dword [ebp - 0x138]
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x12c]
jl 0x460b2d
sub dword [ebp - 0xd4], 3
push 2
lea edx, [ebp - 0x4c]
push edx
call fcn.0047a3cf
add esp, 8
mov ecx, dword [ebp - 0x110]
cmp dword [ecx + 8], 0xfffffffd
jne 0x460de1
mov word [ebp - 0xe0], 0x80
push 0
push 1
push 0x4cee94
lea eax, [ebp - 0x64]
push eax
call fcn.0047cb6a
add esp, 0x10
add dword [ebp - 0xd4], 2
mov word [ebp - 0xe0], 0x8c
mov word [ebp - 0xe0], 0x98
push 0
push 1
push 0x4ceea4
lea edx, [ebp - 0x6c]
push edx
call fcn.0047cb6a
add esp, 0x10
lea ecx, [ebp - 0x64]
add dword [ebp - 0xd4], 2
mov word [ebp - 0xe0], 0x8c
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0046b130
add esp, 8
mov edx, dword [ebp - 0x3b4]
add edx, 2
mov dword [ebp - 0x148], edx
mov ecx, dword [ebp - 0x3b8]
add ecx, 2
mov dword [ebp - 0x14c], ecx
push 0
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
push dword [ebp - 0x20]
call sub.GDI32.dll_MoveToEx
test eax, eax
mov edx, dword [ebp - 0x3b4]
setne al
add edx, 2
and eax, 1
mov dword [ebp - 0x150], edx
mov ecx, dword [ebp - 0x3b0]
add ecx, 0xfffffffe
mov dword [ebp - 0x154], ecx
push dword [ebp - 0x150]
push dword [ebp - 0x154]
push dword [ebp - 0x20]
call sub.GDI32.dll_LineTo
test eax, eax
setne al
and eax, 1
lea edx, [ebp - 0x20]
push edx
call fcn.0046b26b
pop ecx
lea ecx, [ebp - 0x6c]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0046b130
add esp, 8
mov edx, dword [ebp - 0x3b4]
add edx, 3
mov dword [ebp - 0x158], edx
mov ecx, dword [ebp - 0x3b8]
add ecx, 2
mov dword [ebp - 0x15c], ecx
push 0
push dword [ebp - 0x158]
push dword [ebp - 0x15c]
push dword [ebp - 0x20]
call sub.GDI32.dll_MoveToEx
test eax, eax
mov edx, dword [ebp - 0x3b4]
setne al
add edx, 3
and eax, 1
mov dword [ebp - 0x160], edx
mov ecx, dword [ebp - 0x3b0]
add ecx, 0xfffffffe
mov dword [ebp - 0x164], ecx
push dword [ebp - 0x160]
push dword [ebp - 0x164]
push dword [ebp - 0x20]
call sub.GDI32.dll_LineTo
test eax, eax
setne al
and eax, 1
lea edx, [ebp - 0x20]
push edx
call fcn.0046b26b
pop ecx
sub dword [ebp - 0xd4], 2
add dword [ebp - 0xd4], 2
dec dword [ebp - 0xd4]
push 0
lea ecx, [ebp - 0x6c]
push ecx
call fcn.004770dc
add esp, 8
sub dword [ebp - 0xd4], 2
add dword [ebp - 0xd4], 2
dec dword [ebp - 0xd4]
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.004770dc
add esp, 8
jmp 0x461dec
mov edx, dword [ebp - 0x110]
cmp dword [edx + 8], 0xfffffffc
jne 0x4612cb
mov word [ebp - 0xe0], 0xa4
mov ecx, dword [ebp - 0x110]
add ecx, 0x10
push ecx
lea eax, [ebp - 0x70]
push eax
call fcn.004aa30c
add esp, 8
inc dword [ebp - 0xd4]
mov word [ebp - 0xe0], 0xb0
lea esi, [ebp - 0x3d8]
lea edi, [ebp - 0x3e8]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
cmp byte [ebx + 0x1e], 0
je 0x461030
cmp byte [ebp - 0x106], 0
je 0x460e5b
cmp byte [ebp - 0x105], 0
je 0x460e5b
inc dword [ebp - 0x3d4]
add dword [ebp - 0x3d8], 2
cmp byte [ebx + 0x20], 0
jne 0x460ebc
mov word [ebp - 0xe0], 0xbc
push 0x4cee64
lea eax, [ebp - 0x78]
push eax
call fcn.00486b24
add esp, 8
lea ecx, [ebp - 0x3d8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x168], eax
mov edx, dword [ebp - 0x168]
push dword [edx]
push ecx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne al
and eax, 1
sub dword [ebp - 0xd4], 2
push 2
lea edx, [ebp - 0x78]
push edx
call fcn.00486d2f
add esp, 8
cmp byte [ebp - 0x105], 0
je 0x460f12
push 0x4cee70
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x16c]
push eax
call fcn.0046b5e0
add esp, 0xc
lea edx, [ebp - 0x16c]
push edx
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0x3d8]
push 0x25
push ecx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x20]
push dword [eax + 2]
push edx
call fcn.0046b99b
add esp, 0x14
jmp 0x460fb5
push 1
push 1
lea ecx, [ebp - 0x3d8]
push ecx
call fcn.0049a200
add esp, 0xc
push 0x4ceea4
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x170]
push edx
call fcn.0046b5e0
add esp, 0xc
lea ecx, [ebp - 0x170]
push ecx
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0x3d8]
push 0x25
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x20]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
lea eax, [ebp - 0x3d8]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0049a200
add esp, 0xc
push 0x4cee98
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x174]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x3d8]
lea ecx, [ebp - 0x20]
push 0x25
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x70]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x17c]
mov dword [ebp - 0x180], edx
push ecx
push eax
lea edx, [ebp - 0x178]
push edx
call fcn.0046b5e0
add esp, 0xc
cmp byte [ebp - 0x106], 0
je 0x4612b2
cmp byte [ebp - 0x105], 0
je 0x4612b2
add esp, 0xfffffffc
mov ecx, dword [0x4ceea4]
mov dword [esp], ecx
add esp, 0xfffffffc
mov eax, dword [0x4cee94]
mov dword [esp], eax
lea edx, [ebp - 0x3e8]
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0045f9d4
add esp, 0x10
jmp 0x4612b2
cmp byte [ebx + 0x20], 0
jne 0x461091
mov word [ebp - 0xe0], 0xc8
push 0x4cee64
lea eax, [ebp - 0x80]
push eax
call fcn.00486b24
add esp, 8
lea ecx, [ebp - 0x3d8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x184], eax
mov edx, dword [ebp - 0x184]
push dword [edx]
push ecx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne al
and eax, 1
sub dword [ebp - 0xd4], 2
push 2
lea edx, [ebp - 0x80]
push edx
call fcn.00486d2f
add esp, 8
cmp byte [ebp - 0x105], 0
je 0x4611f0
cmp byte [ebp - 0x106], 0
je 0x461164
push 0x4cee8c
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x188]
push eax
call fcn.0046b5e0
add esp, 0xc
lea edx, [ebp - 0x188]
push edx
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf4], eax
push 0x4cee88
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x18c]
push eax
call fcn.0046b594
add esp, 0xc
lea edx, [ebp - 0x18c]
push edx
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf8], eax
mov word [ebp - 0xe0], 0xd4
push 0x4cee88
lea ecx, [ebp - 0x88]
push ecx
call fcn.00486b24
add esp, 8
lea edx, [ebp - 0x3d8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
push dword [eax]
push edx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne cl
and ecx, 1
sub dword [ebp - 0xd4], 2
push 2
lea eax, [ebp - 0x88]
push eax
call fcn.00486d2f
add esp, 8
jmp 0x46118f
push 0x4cee70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x194]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x194]
push eax
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0x3d8]
push 0x25
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x20]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
cmp byte [ebp - 0x106], 0
je 0x461280
mov edx, dword [ebp - 0xf8]
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x19c], edx
lea edx, [ebp - 0x20]
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
push eax
push edx
lea ecx, [ebp - 0x198]
push ecx
call fcn.0046b594
add esp, 0xc
jmp 0x461280
push 1
push 1
lea eax, [ebp - 0x3d8]
push eax
call fcn.0049a200
add esp, 0xc
push 0x4ceea4
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1a4]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x3d8]
lea ecx, [ebp - 0x20]
push 0x25
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x70]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
lea eax, [ebp - 0x3d8]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0049a200
add esp, 0xc
push 0x4cee98
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1a8]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x3d8]
lea ecx, [ebp - 0x20]
push 0x25
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x70]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
mov eax, dword [ebp - 0xf4]
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], edx
push ecx
push eax
lea edx, [ebp - 0x1ac]
push edx
call fcn.0046b5e0
add esp, 0xc
dec dword [ebp - 0xd4]
push 2
lea ecx, [ebp - 0x70]
push ecx
call fcn.004aac40
add esp, 8
jmp 0x461dec
mov eax, dword [ebp - 0x3c0]
sub eax, dword [ebp - 0x3c8]
inc eax
add dword [ebp - 0x3d8], eax
cmp byte [ebp - 0x106], 0
je 0x461466
mov edx, dword [ebp - 0x110]
cmp dword [edx + 4], 0
jge 0x461304
cmp byte [ebp - 0x107], 0
je 0x4613d5
mov word [ebp - 0xe0], 0xe0
push 0x4cee88
lea ecx, [ebp - 0x98]
push ecx
call fcn.00486b24
add esp, 8
lea edx, [ebp - 0x3d8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
push dword [eax]
push edx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne cl
and ecx, 1
sub dword [ebp - 0xd4], 2
push 2
lea eax, [ebp - 0x98]
push eax
call fcn.00486d2f
add esp, 8
cmp byte [ebp - 0x107], 0
je 0x461436
mov word [ebp - 0xe0], 0xec
push 0x4cee64
lea edx, [ebp - 0xa0]
push edx
call fcn.00486b24
add esp, 8
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x3c8]
mov ecx, dword [ebp - 0x1bc]
push dword [ecx]
push eax
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne dl
and edx, 1
sub dword [ebp - 0xd4], 2
push 2
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00486d2f
add esp, 8
jmp 0x461436
mov word [ebp - 0xe0], 0xf8
push 0x4cee88
lea eax, [ebp - 0xa8]
push eax
call fcn.00486b24
add esp, 8
lea ecx, [ebp - 0x3b8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1c0]
push dword [edx]
push ecx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne al
and eax, 1
sub dword [ebp - 0xd4], 2
push 2
lea edx, [ebp - 0xa8]
push edx
call fcn.00486d2f
add esp, 8
push 0x4cee8c
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x1c4]
push eax
call fcn.0046b5e0
add esp, 0xc
lea edx, [ebp - 0x1c4]
push edx
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf4], eax
jmp 0x4615d8
mov ecx, dword [ebp - 0x110]
cmp dword [ecx + 4], 0
jge 0x46147f
cmp byte [ebp - 0x107], 0
je 0x461546
cmp byte [ebx + 0x20], 0
jne 0x4614e6
mov word [ebp - 0xe0], 0x104
push 0x4cee64
lea eax, [ebp - 0xb0]
push eax
call fcn.00486b24
add esp, 8
lea ecx, [ebp - 0x3d8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x1c8], eax
mov edx, dword [ebp - 0x1c8]
push dword [edx]
push ecx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne al
and eax, 1
sub dword [ebp - 0xd4], 2
push 2
lea edx, [ebp - 0xb0]
push edx
call fcn.00486d2f
add esp, 8
cmp byte [ebp - 0x107], 0
je 0x4615ad
cmp byte [ebp - 0x105], 0
je 0x4615ad
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
push ecx
call fcn.0049a219
add esp, 0xc
lea esi, [ebp - 0x3c8]
add esp, 0xfffffff0
mov ecx, 4
mov edi, esp
lea eax, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0045fb01
add esp, 0x14
lea edx, [ebp - 0x3c8]
push 1
push 1
push edx
call fcn.0049a219
add esp, 0xc
jmp 0x4615ad
cmp byte [ebx + 0x20], 0
jne 0x4615ad
mov word [ebp - 0xe0], 0x110
push 0x4cee64
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00486b24
add esp, 8
lea edx, [ebp - 0x3b8]
add dword [ebp - 0xd4], 2
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
push dword [eax]
push edx
push dword [ebp - 0x20]
call sub.USER32.dll_FillRect
test eax, eax
setne cl
and ecx, 1
sub dword [ebp - 0xd4], 2
push 2
lea eax, [ebp - 0xb8]
push eax
call fcn.00486d2f
add esp, 8
push 0x4cee70
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1d0]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x1d0]
push eax
call fcn.00499d42
pop ecx
mov dword [ebp - 0xf4], eax
mov esi, dword [ebp - 0x3bc]
sub esi, dword [ebp - 0x3c4]
sub esi, dword [ebx + 0x2b]
sar esi, 1
jns 0x4615ee
adc esi, 0
mov word [ebp - 0xe0], 0x14
mov edi, dword [ebp - 0x3c0]
sub edi, dword [ebp - 0x3c8]
sub edi, dword [ebx + 0x27]
sar edi, 1
jns 0x46160d
adc edi, 0
mov eax, dword [ebp - 0x110]
cmp dword [eax + 4], 0
jl 0x4617b1
cmp byte [ebp - 0x106], 0
je 0x461694
cmp byte [ebp - 0x105], 0
je 0x461694
cmp byte [ebp - 0x107], 0
je 0x461668
add esp, 0xfffffffc
mov edx, dword [0x4ceea4]
mov dword [esp], edx
add esp, 0xfffffffc
mov ecx, dword [0x4cee94]
mov dword [esp], ecx
lea eax, [ebp - 0x3c8]
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.0045f9d4
add esp, 0x10
jmp 0x4616f4
add esp, 0xfffffffc
mov ecx, dword [0x4cee94]
mov dword [esp], ecx
add esp, 0xfffffffc
mov eax, dword [0x4ceea4]
mov dword [esp], eax
lea edx, [ebp - 0x3c8]
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0045f9d4
add esp, 0x10
jmp 0x4616f4
cmp byte [ebp - 0x107], 0
je 0x4616c9
add esp, 0xfffffffc
mov eax, dword [0x4ceea4]
mov dword [esp], eax
add esp, 0xfffffffc
mov edx, dword [0x4cee94]
mov dword [esp], edx
lea ecx, [ebp - 0x3c8]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0045f9d4
add esp, 0x10
jmp 0x4616f4
add esp, 0xfffffffc
mov edx, dword [0x4cee64]
mov dword [esp], edx
add esp, 0xfffffffc
mov ecx, dword [0x4cee64]
mov dword [esp], ecx
lea eax, [ebp - 0x3c8]
push eax
lea edx, [ebp - 0x20]
push edx
call fcn.0045f9d4
add esp, 0x10
push 0
push 1
mov ecx, dword [ebp - 0x3c4]
lea edx, [ebp - 0x20]
add ecx, esi
push ecx
mov eax, dword [ebp - 0x3c8]
add eax, edi
push eax
push edx
mov ecx, dword [ebp - 0x110]
push dword [ecx + 4]
push dword [ebx + 0x23]
call fcn.00478280
add esp, 0x1c
cmp byte [ebp - 0x105], 0
jne 0x461861
mov eax, dword [ebp - 0x3c4]
add eax, esi
add eax, dword [ebx + 0x2b]
mov dword [ebp - 0x1d4], eax
mov edx, dword [ebp - 0x3c8]
add edx, edi
add edx, dword [ebx + 0x27]
mov dword [ebp - 0x1d8], edx
add esi, dword [ebp - 0x3c4]
mov dword [ebp - 0x1dc], esi
add edi, dword [ebp - 0x3c8]
mov dword [ebp - 0x1e0], edi
mov ecx, dword [ebp - 0x1e0]
mov dword [ebp - 0x3f8], ecx
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x3f8]
mov edx, dword [ebp - 0x1d8]
mov dword [ebp - 0x3f0], edx
lea edx, [ebp - 0x20]
mov ecx, dword [ebp - 0x1d4]
mov dword [ebp - 0x3ec], ecx
push eax
push edx
call fcn.0045fb7c
add esp, 8
jmp 0x461861
cmp byte [ebp - 0x107], 0
je 0x461861
push 0xffffffffffffffff
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
push ecx
call fcn.0049a219
add esp, 0xc
add esp, 0xfffffffc
mov eax, dword [0x4ceea4]
mov dword [esp], eax
add esp, 0xfffffffc
mov edx, dword [0x4cee94]
mov dword [esp], edx
lea ecx, [ebp - 0x3c8]
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0045f9d4
add esp, 0x10
cmp byte [ebp - 0x108], 0
je 0x461838
cmp byte [ebp - 0x10a], 0
je 0x461838
mov dl, byte [ebp - 0x106]
lea eax, [ebp - 0x20]
push edx
mov cl, byte [ebp - 0x105]
push ecx
add esi, dword [ebp - 0x3c4]
push esi
add edi, dword [ebp - 0x3c8]
push edi
push eax
push ebx
call fcn.0046399a
add esp, 0x18
jmp 0x461861
mov dl, byte [ebp - 0x106]
lea eax, [ebp - 0x20]
push edx
mov cl, byte [ebp - 0x105]
push ecx
add esi, dword [ebp - 0x3c4]
push esi
add edi, dword [ebp - 0x3c8]
push edi
push eax
push ebx
call fcn.00462f18
add esp, 0x18
mov word [ebp - 0xe0], 0x11c
lea edx, [ebp - 0x8c]
push edx
call fcn.004aa26c
pop ecx
inc dword [ebp - 0xd4]
mov word [ebp - 0xe0], 0x128
mov word [ebp - 0xe0], 0x134
mov ecx, dword [ebp - 0x110]
add ecx, 0x10
push ecx
lea eax, [ebp - 0x90]
push eax
call fcn.004aa30c
add esp, 8
inc dword [ebp - 0xd4]
mov word [ebp - 0xe0], 0x128
mov edx, dword [ebp - 0x90]
push dword [edx + 2]
call fcn.0049af74
pop ecx
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x90]
lea edx, [ebp - 0x1f8]
mov eax, dword [ecx + 2]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1f0], eax
push edx
push dword [ebp - 0x1ec]
push dword [ebp - 0x1f0]
push ecx
mov eax, dword [ebp - 0x1b]
call dword [eax + 0x58]
pop ecx
push eax
call sub.GDI32.dll_GetTextExtentPointA
mov edx, dword [ebp - 0x1f8]
mov dword [ebp - 0x1e8], edx
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp - 0x1e4], ecx
mov eax, dword [ebp - 0x3cc]
sub eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x1e4]
sar eax, 1
jns 0x461930
adc eax, 0
mov dword [ebp - 0x1fc], eax
mov edx, dword [ebp - 0x1fc]
add dword [ebp - 0x3d4], edx
add dword [ebp - 0x3d8], 2
sub dword [ebp - 0x3d0], 0xf
mov word [ebp - 0xe0], 0x140
push 0x4c3760
lea ecx, [ebp - 0xbc]
push ecx
call fcn.004aa30c
add esp, 8
lea eax, [ebp - 0xbc]
inc dword [ebp - 0xd4]
lea edx, [ebp - 0x90]
push 0
push eax
push edx
call fcn.004aa614
add esp, 0xc
mov ebx, eax
dec dword [ebp - 0xd4]
lea eax, [ebp - 0xbc]
push 2
push eax
call fcn.004aac40
add esp, 8
mov word [ebp - 0xe0], 0x128
cmp ebx, 0xffffffff
jne 0x461a06
mov word [ebp - 0xe0], 0x14c
push 0x4c3762
lea edx, [ebp - 0xc0]
push edx
call fcn.004aa30c
add esp, 8
lea ecx, [ebp - 0xc0]
inc dword [ebp - 0xd4]
lea eax, [ebp - 0x90]
push 0
push ecx
push eax
call fcn.004aa614
add esp, 0xc
mov ebx, eax
dec dword [ebp - 0xd4]
lea eax, [ebp - 0xc0]
push 2
push eax
call fcn.004aac40
add esp, 8
test ebx, ebx
jl 0x461c77
mov word [ebp - 0xe0], 0x158
lea edx, [ebx + 1]
push edx
lea ecx, [ebp - 0x90]
push ecx
lea eax, [ebp - 0xc4]
push eax
call fcn.004ab294
add esp, 0xc
lea edx, [ebp - 0xc4]
inc dword [ebp - 0xd4]
mov dword [ebp - 0x200], edx
push 0xffffffffffffffff
push 0
push dword [ebp - 0x200]
lea ecx, [ebp - 0x8c]
push ecx
call fcn.004a9f54
add esp, 0x10
dec dword [ebp - 0xd4]
push 2
lea eax, [ebp - 0xc4]
push eax
call fcn.004aac40
add esp, 8
mov word [ebp - 0xe0], 0x164
push ebx
push 0
lea edx, [ebp - 0x90]
push edx
lea ecx, [ebp - 0xc8]
push ecx
call fcn.004ab2ec
add esp, 0x10
lea eax, [ebp - 0xc8]
inc dword [ebp - 0xd4]
mov dword [ebp - 0x204], eax
push 0xffffffffffffffff
push 0
push dword [ebp - 0x204]
lea edx, [ebp - 0x90]
push edx
call fcn.004a9f54
add esp, 0x10
dec dword [ebp - 0xd4]
push 2
lea ecx, [ebp - 0xc8]
push ecx
call fcn.004aac40
add esp, 8
cmp byte [ebp - 0x105], 0
jne 0x461c32
cmp byte [ebp - 0x106], 0
jne 0x461bd5
lea esi, [ebp - 0x3d8]
lea edi, [ebp - 0x408]
mov ecx, 4
lea eax, [ebp - 0x408]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0xe0], 0x128
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0049a219
add esp, 0xc
push 0x4ceea4
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x208]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x408]
lea ecx, [ebp - 0x20]
push 4
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x90]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
lea eax, [ebp - 0x408]
lea ecx, [ebp - 0x20]
push 6
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x8c]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
push 0x4cee98
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x20c]
push edx
call fcn.0046b5e0
add esp, 0xc
lea ecx, [ebp - 0x3d8]
lea edx, [ebp - 0x20]
push 4
push ecx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x90]
push dword [eax + 2]
push edx
call fcn.0046b99b
add esp, 0x14
lea ecx, [ebp - 0x3d8]
lea edx, [ebp - 0x20]
push 6
push ecx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x8c]
push dword [eax + 2]
push edx
call fcn.0046b99b
add esp, 0x14
jmp 0x461d8c
push 0x4cee64
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x210]
push eax
call fcn.0046b5e0
add esp, 0xc
lea edx, [ebp - 0x3d8]
lea eax, [ebp - 0x20]
push 4
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x90]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
lea edx, [ebp - 0x3d8]
lea eax, [ebp - 0x20]
push 6
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x8c]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
jmp 0x461d8c
lea edx, [ebp - 0x3d8]
push 4
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x20]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
lea edx, [ebp - 0x3d8]
lea eax, [ebp - 0x20]
push 6
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x8c]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
jmp 0x461d8c
cmp byte [ebp - 0x105], 0
jne 0x461d6c
cmp byte [ebp - 0x106], 0
jne 0x461d32
lea esi, [ebp - 0x3d8]
lea edi, [ebp - 0x418]
mov ecx, 4
lea eax, [ebp - 0x418]
rep movsd dword es:[edi], dword [esi]
mov word [ebp - 0xe0], 0x128
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0049a219
add esp, 0xc
push 0x4ceea4
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x214]
push ecx
call fcn.0046b5e0
add esp, 0xc
lea eax, [ebp - 0x418]
lea ecx, [ebp - 0x20]
push 0x44
push eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x90]
push dword [edx + 2]
push ecx
call fcn.0046b99b
add esp, 0x14
push 0x4cee98
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x218]
push edx
call fcn.0046b5e0
add esp, 0xc
lea ecx, [ebp - 0x3d8]
lea edx, [ebp - 0x20]
push 0x44
push ecx
push 0xffffffffffffffff
mov eax, dword [ebp - 0x90]
push dword [eax + 2]
push edx
call fcn.0046b99b
add esp, 0x14
jmp 0x461d8c
push 0x4cee64
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x21c]
push eax
call fcn.0046b5e0
add esp, 0xc
lea edx, [ebp - 0x3d8]
lea eax, [ebp - 0x20]
push 0x44
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x90]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
jmp 0x461d8c
lea edx, [ebp - 0x3d8]
push 0x44
push edx
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x20]
push dword [ecx + 2]
push eax
call fcn.0046b99b
add esp, 0x14
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0x228]
mov dword [ebp - 0x224], edx
lea edx, [ebp - 0x20]
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x228], ecx
push eax
push edx
lea ecx, [ebp - 0x220]
push ecx
call fcn.0046b5e0
add esp, 0xc
dec dword [ebp - 0xd4]
push 2
lea eax, [ebp - 0x90]
push eax
call fcn.004aac40
add esp, 8
dec dword [ebp - 0xd4]
push 2
lea edx, [ebp - 0x8c]
push edx
call fcn.004aac40
add esp, 8
mov ebx, dword [ebp - 0x118]
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 0x1b]
call dword [edx + 0x58]
pop ecx
cmp eax, dword [ebp - 0x20]
je 0x461e0b
push ebx
push dword [ebp - 0x20]
call sub.GDI32.dll_SetBkMode
push ebx
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [ebp - 0x1b]
call dword [eax + 0x58]
pop ecx
push eax
call sub.GDI32.dll_SetBkMode
lea edx, [ebp - 0x20]
push edx
call fcn.0046b2bf
pop ecx
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0xcc], ecx
cmp dword [ebp - 0xcc], 0
je 0x461e77
mov word [ebp - 0xe0], 0x17c
add dword [ebp - 0xd4], 2
dec dword [ebp - 0xd4]
push 0
push dword [ebp - 0xcc]
call fcn.004770dc
add esp, 8
push dword [ebp - 0xcc]
call fcn.004a788c
pop ecx
mov word [ebp - 0xe0], 0x170
dec dword [ebp - 0xd4]
push 2
lea eax, [ebp - 0x20]
push eax
call fcn.0046b0fd
add esp, 8
mov al, 1
mov edx, dword [ebp - 0xf0]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret