Function at 0x4f1600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x36c
mov eax, dword [0x596fb8]
xor eax, esp
mov dword [esp + 0x368], eax
mov eax, dword [esp + 0x374]
push ebp
mov ebp, dword [esp + 0x374]
push esi
mov esi, ecx
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x68], eax
call fcn.00510e30
test eax, eax
je 0x4f1647
mov dword [esi + 0x208], 1
jmp 0x4f3684
cmp dword [esi + 0x354], 1
mov edx, dword [esi + 0x2e4]
push ebx
push edi
lea ecx, [esp + 0x80]
push ecx
push edx
jne 0x4f25bc
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x358]
mov edi, dword [0x58def8]
mov eax, dword [esp + 0x8c]
sub eax, dword [esp + 0x84]
mov edx, ecx
mov dword [esp + 0x44], eax
imul edx, edi
mov eax, dword [esp + 0x88]
sub eax, dword [esp + 0x80]
push ebp
mov dword [esp + 0x4c], eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
lea edx, [edi*4]
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edi, [ebx + eax*2]
mov ebx, dword [0x58def4]
imul ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
add edi, dword [esi + 0x368]
sar edx, 4
mov ecx, edx
add ebx, ebx
shr ecx, 0x1f
add ecx, edx
add ebx, ebx
mov eax, 0x2aaaaaab
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ebx, [ecx + eax*2]
call fcn.004eec20
cmp byte [esi + 0x184], 0
je 0x4f1729
mov ecx, dword [esi + 0x38c]
push 0x100
push ecx
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [esp + 0x68], eax
cmp dword [esi + 0x354], 1
push esi
jne 0x4f1747
call fcn.004edf40
mov ebx, eax
imul ebx, dword [esi + 0x35c]
mov dword [esp + 0x1c], ebx
jmp 0x4f1752
call fcn.004edf40
mov ebx, eax
mov dword [esp + 0x1c], eax
push esi
mov edi, 0x20
call fcn.004eeb10
cmp eax, 1
je 0x4f1767
mov edi, 0xa0
push 2
push esi
call fcn.004eca70
test eax, eax
je 0x4f1776
or edi, 1
push 5
push esi
call fcn.004eca70
test eax, eax
je 0x4f1785
or edi, 4
push 6
push esi
call fcn.004eca70
test eax, eax
je 0x4f1794
or edi, 2
push 7
push esi
call fcn.004eca70
test eax, eax
je 0x4f17a3
or edi, 8
push 8
push esi
call fcn.004eca70
test eax, eax
je 0x4f17b2
or edi, 0x10
push 4
push esi
call fcn.004eca70
test eax, eax
je 0x4f17c1
or edi, 0x40
cmp byte [0x597f11], 0
je 0x4f17cd
or edi, 0x1f
call fcn.004ef0f0
test eax, eax
je 0x4f17d9
or edi, 0x1f
push edi
push ebx
push esi
call fcn.004ee360
push eax
push ebx
push esi
call fcn.00510e50
lea edx, [esp + 0x258]
xor edi, edi
push edx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
call fcn.00401210
lea eax, [esp + 0x148]
push eax
call fcn.00401210
mov ecx, dword [0x5980bc]
push edi
push ecx
call fcn.00408530
mov edi, dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x38], eax
call edi
cmp eax, dword [esi + 0x2e4]
je 0x4f1841
cmp dword [esi + 0x158], 0
je 0x4f184c
call edi
cmp eax, dword [esi + 0x158]
jne 0x4f184c
mov edx, dword [0x5980bc]
push 4
push edx
jmp 0x4f1854
mov eax, dword [0x5980bc]
push 6
push eax
call fcn.00408530
mov ebx, dword [esp + 0x38]
push ebx
push ebp
mov dword [esp + 0x38], eax
call fcn.004ae020
mov ecx, dword [esp + 0x30]
push ecx
mov edi, eax
push ebp
mov dword [esp + 0x3c], edi
call fcn.004ae020
mov dword [esp + 0x64], eax
mov eax, dword [0x58def8]
lea ecx, [eax + eax*2]
add ecx, ecx
add ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
push edi
push ebx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov edx, dword [esp + 0x50]
push edx
push esi
call fcn.004edf40
imul eax, dword [esi + 0x364]
neg eax
push eax
push 0
push ebp
push esi
xor eax, eax
xor edi, edi
call fcn.004edd00
mov eax, dword [0x58def8]
lea ecx, [eax + eax*2]
add ecx, ecx
add ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
push 1
add edi, edx
push esi
mov dword [esp + 0x20], edi
call fcn.00510d40
mov dword [esp + 0x40], eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x2e4]
jne 0x4f1901
push 2
push esi
call fcn.00510d40
mov eax, dword [esi + 0x368]
sub eax, dword [esi + 0x10c]
cdq
sub eax, edx
sar eax, 1
cmp edi, dword [esp + 0x44]
mov dword [esp + 0x74], eax
jge 0x4f2538
push esi
call fcn.00510a20
cmp dword [esp + 0x1c], eax
jge 0x4f2538
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
push eax
push ecx
mov ecx, dword [0x58def4]
shl ecx, 4
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.004edf40
imul eax, dword [esi + 0x364]
mov ebx, dword [esi + 0x364]
neg eax
push eax
push 0
push ebp
mov eax, edi
push esi
xor edi, edi
call fcn.004edd00
mov ebx, dword [0x58def4]
mov ecx, ebx
shl ecx, 4
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x35c]
test eax, eax
mov dword [esp + 0x60], eax
je 0x4f2422
mov ebp, dword [esp + 0x24]
jmp 0x4f19b6
mov ebx, dword [0x58def4]
mov ecx, dword [esi + 0x358]
mov edx, ecx
imul ecx, ebx
imul edx, dword [0x58def8]
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x58def8]
add edx, edx
add edx, edx
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [edi + eax*2]
add edx, dword [esi + 0x368]
mov eax, 0x2aaaaaab
push edx
lea edx, [ebx*4]
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x1c]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x24]
push ecx
push edx
push ebp
push eax
call fcn.004ac6b0
test eax, eax
je 0x4f234d
push esi
call fcn.00510a20
cmp dword [esp + 0x1c], eax
jge 0x4f2422
mov ecx, dword [esp + 0x5c]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0x24]
lea edx, [edi + ecx]
neg edx
push edx
mov edx, dword [esp + 0x70]
lea ecx, [ebx + eax]
neg ecx
push ecx
push edx
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov eax, ebx
mov ebx, dword [esi + 0x38c]
neg eax
push 0
mov dword [esp + 0x7c], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0xa4]
push eax
neg edi
push 0
mov dword [esp + 0x68], edi
mov edi, dword [esp + 0x28]
push edi
push esi
call fcn.004f00a0
mov ecx, dword [esp + 0xa8]
push ecx
push ebx
call fcn.004ae020
mov edx, dword [esp + 0xc8]
push edx
push ebx
mov dword [esp + 0x58], eax
call fcn.004ae020
mov dword [esp + 0x70], eax
lea eax, [esp + 0xdc]
push eax
push 0xa0
push edi
push esi
call fcn.00510e90
push edi
push esi
call fcn.00510b00
push edi
push esi
call fcn.00510f90
mov ebp, dword [esi + 0x358]
mov ecx, ebp
imul ebp, dword [0x58def4]
imul ecx, dword [0x58def8]
mov edi, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, 0x2aaaaaab
imul ebp
sar edx, 4
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x58def8]
add edx, edx
add edx, edx
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x58def4]
add edx, edx
mov dword [esp + 0x14], eax
add edx, edx
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x50]
push edx
mov edx, dword [esi + 0x368]
add edx, ecx
push edx
mov edx, dword [esp + 0x1c]
push ebp
push edx
push eax
mov dword [esp + 0x50], eax
mov eax, dword [esi + 0x368]
lea edx, [eax + edx*2]
mov eax, dword [esp + 0x50]
add edx, ecx
push edx
lea ecx, [ebp + eax*2]
push ecx
push 0
push 0
push ebx
call fcn.004aac90
cmp dword [esp + 0xb0], 0x18
jne 0x4f1d26
cmp byte [0x5980cb], 0
je 0x4f1bcc
mov eax, dword [0x5980c8]
movzx ecx, byte [0x5980ca]
movzx edx, ah
mov dword [esp + 0x30], edx
and eax, 0xff
jmp 0x4f1c3f
mov eax, dword [0x5980bc]
push 4
push eax
call fcn.00408530
movzx ecx, byte [esp + 0xa8]
movzx eax, al
add eax, ecx
cdq
sub eax, edx
mov edx, dword [0x5980bc]
push 4
sar eax, 1
push edx
mov dword [esp + 0x1c], eax
call fcn.00408530
movzx ecx, byte [esp + 0xa9]
movzx eax, ah
add eax, ecx
cdq
sub eax, edx
mov edx, dword [0x5980bc]
push 4
sar eax, 1
push edx
mov dword [esp + 0x38], eax
call fcn.00408530
mov ecx, dword [esp + 0xa8]
shr eax, 0x10
shr ecx, 0x10
movzx eax, al
movzx edx, cl
mov cl, byte [esp + 0x14]
add eax, edx
cdq
sub eax, edx
sar eax, 1
xor edx, edx
mov dh, al
movzx eax, cl
mov dl, byte [esp + 0x30]
shl edx, 8
or edx, eax
push edx
push ebx
call fcn.004ae020
test eax, eax
mov dword [esp + 0x30], eax
je 0x4f1d26
mov ebp, dword [0x58def8]
lea ecx, [ebp*4]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esi + 0x358]
imul edx, ebp
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov edx, dword [0x58def4]
add edx, edx
add edx, edx
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x358]
imul eax, dword [0x58def4]
mov edx, eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x30]
push edx
mov edx, dword [esi + 0x368]
lea edx, [edx + ecx*2]
lea edx, [edx + ebp - 2]
push edx
mov edx, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
lea eax, [eax + edx*2 - 2]
push eax
mov eax, dword [esi + 0x368]
push 1
push 1
lea ecx, [eax + ecx*2]
mov eax, dword [esp + 0x28]
add ecx, ebp
push ecx
lea ecx, [eax + edx*2]
push ecx
push 0
push 0
push ebx
call fcn.004aac90
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
push 2
push esi
call fcn.00510d40
cmp eax, dword [esp + 0x1c]
jne 0x4f1dea
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x2e4]
jne 0x4f1dea
mov ecx, dword [esi + 0x358]
mov ebp, dword [0x58def8]
mov eax, dword [esp + 0xa8]
push eax
mov edx, ecx
imul edx, ebp
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x18], eax
lea edx, [ebp*4]
mov ebp, dword [0x58def4]
mov eax, 0x2aaaaaab
imul ecx, ebp
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x18]
lea edx, [edx + eax*2]
add edx, dword [esi + 0x368]
push 0
push 0
push edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x24], eax
lea ecx, [ebp*4]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x24]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ecx + eax*2]
push ecx
push 0
push 0
push ebx
call fcn.004a8460
mov ecx, dword [esi + 0x358]
mov edx, ecx
imul ecx, dword [0x58def4]
imul edx, dword [0x58def8]
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x58def8]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add ecx, ecx
add ecx, ecx
push ebp
push eax
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x58def4]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, dword [esp + 0x20]
add ecx, ecx
push eax
add ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
call fcn.004ac6b0
test eax, eax
je 0x4f1fa1
mov eax, dword [esp + 0x108]
test eax, eax
mov ecx, dword [esi + 0x358]
mov ebp, dword [0x58def4]
je 0x4f1f18
mov edx, dword [esp + 0xa8]
neg edi
sbb edi, edi
and edi, 0xffffff81
add edi, 0xff
push edi
mov edi, dword [0x58def8]
push edx
push eax
mov edx, ecx
imul ecx, ebp
imul edx, edi
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add edi, edi
add edi, edi
mov eax, 0x2aaaaaab
imul edi
sar edx, 4
mov eax, edx
push ecx
shr eax, 0x1f
add eax, edx
push eax
add ebp, ebp
add ebp, ebp
mov eax, 0x2aaaaaab
imul ebp
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push ebx
lea edx, [esi + 0x3b8]
push edx
call fcn.004bddc0
jmp 0x4f1fa1
mov eax, dword [esp + 0xa8]
mov edx, dword [esp + 0x104]
neg edi
sbb edi, edi
and edi, 0xffffff81
add edi, 0xff
push edi
mov edi, dword [0x58def8]
push eax
push edx
mov edx, ecx
imul ecx, ebp
imul edx, edi
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add edi, edi
add edi, edi
mov eax, 0x2aaaaaab
imul edi
sar edx, 4
mov eax, edx
push ecx
shr eax, 0x1f
add eax, edx
push eax
add ebp, ebp
add ebp, ebp
mov eax, 0x2aaaaaab
imul ebp
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push ebx
lea edx, [esi + 0x3b8]
push edx
call fcn.004bf7c0
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x25c]
push ecx
push edx
push esi
call fcn.00510c40
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x258]
mov edx, dword [esp + 0x260]
push eax
push ecx
push edx
lea eax, [esp + 0xac]
push eax
push ebx
call fcn.004ad7f0
mov ecx, dword [esi + 0x358]
mov edi, dword [0x58def4]
mov edx, ecx
imul edx, edi
mov dword [esp + 0x3c], eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
lea edx, [edi*4]
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp dword [esp + 0x3c], ebp
jg 0x4f203a
mov eax, ebp
cdq
sub eax, edx
sar eax, 1
add edi, eax
mov eax, dword [esp + 0x3c]
cdq
sub eax, edx
sar eax, 1
sub edi, eax
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x40]
mov dword [esp + 0x30], edi
je 0x4f20c0
imul ecx, dword [0x58def8]
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [esp + 0x150]
sar edx, 4
mov ecx, edx
push 0
push eax
mov eax, dword [esp + 0x268]
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x260]
push edx
push eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0xb0]
push edx
mov edx, dword [esp + 0x88]
push eax
mov eax, dword [esi + 0x368]
push edx
mov edx, dword [0x58def8]
push eax
add edx, edx
add edx, edx
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
push ebp
add eax, edx
add eax, ecx
push eax
push edi
push ebx
call fcn.004b2a90
mov dword [esp + 0x30], eax
mov ecx, dword [esi + 0x358]
mov ebp, dword [0x58def8]
mov edx, ecx
imul edx, ebp
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [ebp*4]
mov ebp, eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add ebp, edx
mov edx, dword [esp + 0x50]
push edx
mov edx, dword [esi + 0x368]
add ebp, eax
mov eax, dword [esp + 0x34]
push edx
sub eax, edi
push eax
push ebp
push edi
mov edi, dword [0x58def4]
imul ecx, edi
push edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
lea ecx, [edi*4]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
push ebp
add ecx, edx
push ecx
push ebx
call fcn.004aac90
mov eax, dword [esi + 0x30c]
cmp eax, 1
je 0x4f2163
cmp eax, 2
jne 0x4f2299
mov ecx, dword [esi + 0x358]
mov edi, dword [0x58def4]
mov edx, ecx
imul edx, edi
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
lea edx, [edi*4]
mov edi, dword [0x58def8]
mov eax, 0x2aaaaaab
imul ecx, edi
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x14]
lea edx, [edx + eax*2]
mov dword [esp + 0x370], edx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], eax
lea ecx, [edi*4]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [ecx + eax*2]
add ecx, dword [esi + 0x368]
lea edi, [esi + 0x214]
push edi
lea edx, [esp + 0x94]
xor ebp, ebp
push edx
mov dword [esp + 0x370], ebp
mov dword [esp + 0x374], ebp
mov dword [esp + 0x37c], ecx
call dword [sym.imp.USER32.dll_CopyRect]
push esi
call fcn.004edf40
imul eax, dword [esi + 0x364]
add eax, dword [esp + 0x18]
neg eax
push eax
push esi
call fcn.004edfc0
mov ecx, dword [esp + 0x7c]
sub ecx, eax
push ecx
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
cmp dword [esi + 0x224], ebp
je 0x4f2279
mov ecx, dword [esp + 0x6c]
push ecx
lea edx, [esp + 0x36c]
push edx
lea eax, [esp + 0x98]
push eax
push ebx
lea ecx, [esi + 0x3a0]
push ecx
call fcn.004b05f0
jmp 0x4f2299
mov edx, dword [esi + 0x218]
mov eax, dword [edi]
push edx
push eax
lea ecx, [esp + 0x370]
push ecx
lea edx, [esp + 0x9c]
push edx
push ebx
call fcn.004a8630
mov ecx, dword [esi + 0x358]
mov edi, dword [0x58def8]
mov eax, dword [esi + 0x38c]
mov edx, ecx
imul edx, edi
push 0xcc0020
push 0
push 0
push eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add edi, edi
add edi, edi
mov eax, 0x2aaaaaab
imul edi
mov edi, dword [0x58def4]
sar edx, 4
imul ecx, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [ebx + eax*2]
add edx, dword [esi + 0x368]
mov eax, 0x2aaaaaab
push edx
imul ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
lea ecx, [edi*4]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x2c]
lea ecx, [ebx + eax*2]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x70]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push edx
call edi
mov eax, dword [esp + 0x50]
push eax
call edi
mov ebp, dword [esp + 0x24]
mov ecx, dword [esi + 0x358]
mov edx, ecx
imul ecx, dword [0x58def4]
imul edx, dword [0x58def8]
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [0x58def4]
sar edx, 4
mov edi, edx
add ecx, ecx
add ecx, ecx
shr edi, 0x1f
add edi, edx
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [esp + 0x38]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x34]
push edx
mov edx, dword [0x58def8]
push eax
add edx, edx
add edx, edx
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x360]
sub edx, edi
add ecx, ecx
sub edx, ecx
push edx
lea ebx, [ebx + eax*2]
add ebx, dword [esi + 0x368]
add edi, ecx
push esi
add edi, ebp
call fcn.004edf40
imul eax, dword [esi + 0x364]
neg eax
push eax
mov eax, dword [esp + 0x30]
push 0
push eax
mov eax, dword [esp + 0x30]
push esi
call fcn.004edd00
mov eax, dword [esp + 0x60]
add ebp, dword [esi + 0x360]
add dword [esp + 0x1c], 1
sub eax, 1
test eax, eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x60], eax
jne 0x4f19b0
mov edi, dword [0x58def8]
mov ecx, dword [esi + 0x358]
imul ecx, edi
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [esp + 0x38]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esp + 0x34]
push edx
push eax
lea edx, [edi*4]
mov edi, dword [esp + 0x2c]
mov eax, 0x2aaaaaab
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ebx, [ecx + eax*2]
mov ecx, dword [esp + 0x50]
add ebx, dword [esi + 0x368]
sub ecx, edi
push ecx
push esi
call fcn.004edf40
imul eax, dword [esi + 0x364]
mov edx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
neg eax
push eax
push 0
push edx
push esi
mov eax, ebp
call fcn.004edd00
mov edi, dword [0x58def8]
mov ecx, dword [esi + 0x358]
imul ecx, edi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ebx, dword [esi + 0x364]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [edi*4]
mov edi, dword [esp + 0x34]
mov eax, 0x2aaaaaab
imul edx
push edi
mov edi, dword [esp + 0x3c]
sar edx, 4
push edi
mov edi, dword [esp + 0x50]
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x368]
push edi
add eax, eax
sub ebx, ecx
lea edi, [ecx + edx]
sub ebx, edx
add edi, eax
push esi
sub ebx, eax
add edi, ebp
call fcn.004edf40
imul eax, dword [esi + 0x364]
neg eax
push eax
mov eax, dword [esp + 0x30]
push 0
push eax
mov eax, edi
push esi
xor edi, edi
call fcn.004edd00
add ebp, dword [esi + 0x364]
cmp ebp, dword [esp + 0x44]
mov dword [esp + 0x18], ebp
mov edi, ebp
mov ebp, dword [esp + 0x20]
jl 0x4f1920
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
push ecx
push edx
push eax
push esi
sub ebx, edi
call fcn.004edf40
imul eax, dword [esi + 0x364]
neg eax
push eax
push 0
push ebp
mov eax, edi
push esi
xor edi, edi
call fcn.004edd00
mov ecx, dword [esp + 0x64]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
push ecx
call edi
mov edx, dword [esp + 0x34]
push edx
call edi
lea eax, [esp + 0x148]
push eax
call fcn.00401230
lea ecx, [esp + 0x258]
push ecx
call fcn.00401230
cmp byte [esi + 0x184], 0
je 0x4f3682
mov edx, dword [esp + 0x68]
mov eax, dword [esi + 0x38c]
push edx
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x4f3682
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call fcn.004edfc0
mov eax, dword [esp + 0x88]
sub eax, dword [esp + 0x80]
mov ecx, dword [esi + 0x118]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x8c]
sub eax, ecx
sub eax, dword [esp + 0x84]
mov dword [esp + 0x2c], ecx
add eax, ecx
cmp byte [0x58a6ae], 0
mov dword [esp + 0x48], eax
mov dword [esp + 0x20], ebp
je 0x4f264c
mov eax, dword [esp + 0x38]
mov edi, dword [esi + 0x368]
add eax, 0xf
cdq
and edx, 0xf
add eax, edx
mov ebx, eax
sar ebx, 4
shl ebx, 4
push ebp
call fcn.004eec20
mov eax, dword [esi + 0x118]
mov edi, dword [esp + 0x6c]
mov ebp, dword [esi + 0x38c]
neg eax
push eax
push 0
push edi
call dword [sym.imp.GDI32.dll_OffsetRgn]
push edi
push ebp
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0x2c
lea ecx, [esp + 0xa4]
push 0
push ecx
call fcn.00549e40
add esp, 0xc
push esi
mov dword [esp + 0xa4], 9
call fcn.004ecc00
xor ebx, ebx
test eax, eax
mov dword [esp + 0x34], eax
jle 0x4f26c8
mov edi, dword [0x597e34]
mov eax, dword [esi + 0x6c]
lea edx, [esp + 0xa0]
push edx
push 0
push ebx
push 0x120f
push eax
call edi
mov ecx, dword [esi + 0x6c]
push eax
push 0x120b
push ecx
call edi
mov dl, byte [esp + 0xb8]
mov eax, dword [esp + 0xa4]
mov byte [esp + ebx + 0x368], dl
mov dword [esp + ebx*4 + 0x114], eax
add ebx, 1
cmp ebx, dword [esp + 0x34]
jl 0x4f2681
cmp dword [esi + 0x354], 1
push esi
jne 0x4f26e6
call fcn.004edf40
mov ebx, eax
imul ebx, dword [esi + 0x35c]
mov dword [esp + 0x10], ebx
jmp 0x4f26f1
call fcn.004edf40
mov ebx, eax
mov dword [esp + 0x10], eax
cmp byte [esi + 0x184], 0
je 0x4f270d
push 0x100
push ebp
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov dword [esp + 0xd0], eax
lea ecx, [esp + 0x148]
push ecx
call fcn.00401210
lea edx, [esp + 0x258]
push edx
call fcn.00401210
mov eax, dword [0x5980bc]
push 0
push eax
call fcn.00408530
mov ecx, dword [0x5980bc]
push 0
push ecx
call fcn.00408530
push eax
push ebp
call fcn.004ae020
push 2
mov edi, 0x20
push esi
mov dword [esp + 0xdc], eax
mov dword [esp + 0x54], edi
call fcn.004eca70
test eax, eax
je 0x4f276e
mov edi, 0x21
mov dword [esp + 0x4c], edi
push 5
push esi
call fcn.004eca70
test eax, eax
je 0x4f2781
or edi, 4
mov dword [esp + 0x4c], edi
push 6
push esi
call fcn.004eca70
test eax, eax
je 0x4f2794
or edi, 2
mov dword [esp + 0x4c], edi
push 7
push esi
call fcn.004eca70
test eax, eax
je 0x4f27a7
or edi, 8
mov dword [esp + 0x4c], edi
push 8
push esi
call fcn.004eca70
test eax, eax
je 0x4f27ba
or edi, 0x10
mov dword [esp + 0x4c], edi
push 4
push esi
call fcn.004eca70
test eax, eax
je 0x4f27cd
or edi, 0x40
mov dword [esp + 0x4c], edi
cmp byte [0x597f11], 0
je 0x4f27dd
or edi, 0x1f
mov dword [esp + 0x4c], edi
call fcn.004ef0f0
test eax, eax
je 0x4f27ed
or edi, 0x1f
mov dword [esp + 0x4c], edi
mov edx, dword [esp + 0x48]
sub edx, dword [esp + 0x2c]
mov ecx, dword [esi + 0x368]
lea eax, [edx + ecx - 1]
cdq
idiv ecx
push edi
push eax
push ebx
push esi
call fcn.00510e50
mov ecx, dword [esi + 0x368]
mov eax, ecx
sub eax, dword [esi + 0x10c]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x74], eax
mov eax, ecx
sub eax, dword [esi + 0x114]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x68], eax
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x2e4]
jne 0x4f2a1b
push 2
push esi
call fcn.00510d40
cmp eax, 0xffffffff
mov dword [esp + 0x58], eax
je 0x4f28f0
cmp byte [0x597f1d], 0
je 0x4f28f0
lea eax, [esp + 0x90]
push eax
push 0
push esi
call fcn.004ec930
push esi
call fcn.004eca10
mov ecx, dword [0x58def4]
add ecx, ecx
mov dword [esp + 0x30], eax
add ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 4
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
add ebx, dword [esi + 0x110]
xor edi, edi
add ebx, dword [esp + 0x90]
cmp dword [esp + 0x34], edi
mov dword [esp + 0x14], ebx
jle 0x4f28ec
mov al, byte [esp + edi + 0x368]
test al, al
je 0x4f28df
lea ecx, [esp + 0x90]
movzx edx, al
push ecx
push edx
push esi
call fcn.004ec930
mov eax, dword [esp + 0x90]
invalid