Function at 0x507000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0xce88ac]
sub esp, 0x68
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x5071ef
mov esi, dword [0xd0ff58]
mov ebx, dword [0xa23354]
mov edx, dword [0xa23358]
sub esi, ebx
mov ebx, dword [0xd0ff5c]
sub esi, 0xa
sub ebx, edx
sub ebx, 0x6a
test esi, esi
jge 0x50703c
xor esi, esi
lea eax, [esi + 0x89]
cmp eax, 0x400
jle 0x50704e
mov esi, 0x377
test ebx, ebx
jge 0x507054
xor ebx, ebx
lea edi, [ebx + 0x60]
lea ebp, [esi + 0x89]
push edi
push ebp
push ebx
push esi
mov ecx, 0xce8890
call fcn.00586bc0
mov eax, dword [0xce88f8]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edi
mov edx, dword [0xce8910]
mov ecx, dword [0xce8924]
push ecx
mov eax, dword [edx]
push eax
push ebx
push esi
call dword [0xd36aac]
mov ecx, dword [0xce88f8]
add esp, 0x10
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x5070bc
mov eax, dword [0xce8918]
mov edx, dword [0xce892c]
push edx
lea edx, [ebx + 0x4b]
mov ecx, dword [eax]
lea eax, [esi + 0x3b]
push ecx
push edx
push eax
jmp 0x5070d4
mov edx, dword [0xce8914]
mov ecx, dword [0xce8928]
push ecx
lea ecx, [ebx + 0x4b]
mov eax, dword [edx]
lea edx, [esi + 0x3b]
push eax
push ecx
push edx
call dword [0xd36aac]
add esp, 0x10
lea eax, [esp + 0x2c]
push eax
push 1
push 0x656284
call fcn.005a9050
mov edi, 0xd11fac
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp eax, edi
jge 0x5071ef
mov edx, edi
lea ecx, [eax + 0xd11fac]
sub edx, eax
push edx
push ecx
push 0x78
call fcn.004418b0
add esp, 0xc
test eax, eax
jne 0x5071b9
mov eax, dword [esp + 0x10]
push 0x78
lea eax, [eax + 0xd11fac]
push eax
call fcn.004417f0
mov ecx, dword [esp + 0x18]
mov edi, eax
lea eax, [edi - 1]
mov dword [esp + 0x20], eax
push eax
lea eax, [ecx + 0xd11fac]
push eax
call fcn.00427910
add esp, 0x10
test eax, eax
je 0x50716f
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
lea eax, [edx + 0xd11fac]
lea edx, [esi + 4]
push eax
mov eax, dword [esp + 0x34]
imul eax, ebp
push 0x6416d0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffff
push edi
lea ecx, [eax + ebx + 3]
push 1
push ecx
push edx
call fcn.005a8380
mov edx, dword [esp + 0x34]
add esp, 0x24
add edx, edi
inc ebp
cmp ebp, 5
mov dword [esp + 0x10], edx
jl 0x50710a
jmp 0x5071ef
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
imul edx, ebp
lea ecx, [eax + 0xd11fac]
sub edi, eax
push ecx
push 0x6416d0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffff
push edi
lea eax, [edx + ebx + 3]
push 1
add esi, 4
push eax
push esi
call fcn.005a8380
add esp, 0x24
mov eax, dword [0xced174]
test eax, eax
je 0x50740d
mov edi, dword [0xd0ff58]
mov ebx, dword [0xa23354]
mov esi, dword [0xd0ff5c]
mov edx, dword [0xa23358]
sub edi, ebx
sub esi, edx
add edi, 0x89
sub esi, 0x6a
test edi, edi
jge 0x507227
xor edi, edi
lea ecx, [edi + 0x89]
cmp ecx, 0x400
jle 0x50723a
mov edi, 0x377
cmp esi, 0x3c
jge 0x507244
mov esi, 0x3c
lea edx, [esi + 0x6a]
lea eax, [edi + 0x89]
push edx
push eax
push esi
push edi
mov ecx, 0xced158
call fcn.00586bc0
mov eax, dword [0xced1c0]
lea ecx, [edi + 0x81]
lea edx, [esi + 0xd]
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [0xced1c0]
lea edx, [esi + 0xe]
add eax, 0x1c
mov dword [eax + 4], edx
lea edx, [esi + 0x1b]
mov dword [eax], edi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [0xced1c0]
add eax, 0x38
lea edx, [esi + 0x1c]
mov dword [eax + 4], edx
lea edx, [esi + 0x29]
mov dword [eax], edi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [0xced1c0]
add eax, 0x54
lea edx, [esi + 0x2a]
mov dword [esp + 0x18], edx
mov dword [eax + 8], ecx
lea ecx, [esi + 0x37]
mov dword [eax], edi
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov eax, dword [0xce890c]
mov edx, dword [0xce8920]
mov ecx, dword [eax]
push edx
push ecx
push esi
push edi
call dword [0xd36aac]
add esp, 0x10
xor ebx, ebx
lea ebp, [esi + 2]
mov edx, dword [0xced1c0]
mov eax, dword [ebx + edx + 0x14]
test eax, eax
je 0x50730d
mov ecx, dword [0xce891c]
mov eax, dword [0xce8930]
push eax
lea eax, [edi + 4]
mov edx, dword [ecx]
push edx
push ebp
push eax
call dword [0xd36aac]
add esp, 0x10
add ebx, 0x1c
add ebp, 0xe
cmp ebx, 0x70
jl 0x5072e2
mov eax, dword [0xce8908]
cmp eax, 3
jne 0x50737d
lea ecx, [esi + 3]
add edi, eax
push 0xffffff
push ecx
push edi
push 0xa53b20
call fcn.0047af10
lea edx, [esi + 0x10]
push 0xffffff
push edx
push edi
push 0xa53b41
call fcn.0047af10
add esi, 0x1d
push 0xffffff
push esi
push edi
push 0xa53b62
call fcn.0047af10
mov eax, dword [esp + 0x48]
push 0xffffff
push eax
push edi
push 0xa53b83
call fcn.0047af10
add esp, 0x40
jmp 0x50740d
cmp eax, 1
jne 0x50740d
mov eax, dword [0xa4f274]
test eax, eax
je 0x5073cb
lea ecx, [esi + 3]
add edi, 3
push 0xffffff
push ecx
push edi
push 0x6689d0
call fcn.0047af10
lea edx, [esi + 0x1d]
push 0xffffff
push edx
push edi
push 0x6689c8
call fcn.0047af10
add esi, 0x10
push 0xffffff
push esi
push edi
push 0x6689c0
jmp 0x507405
lea eax, [esi + 3]
add edi, 3
push 0xffffff
push eax
push edi
push 0x6689b8
call fcn.0047af10
lea ecx, [esi + 0x1d]
push 0xffffff
push ecx
push edi
push 0x6689b0
call fcn.0047af10
add esi, 0x10
push 0xffffff
push esi
push edi
push 0x6689a8
call fcn.0047af10
add esp, 0x30
mov eax, dword [0x667c30]
mov ebp, 0xc
test eax, eax
je 0x507895
mov esi, dword [0xa4f1e0]
test esi, esi
je 0x507895
mov eax, dword [0x6d6ae8]
mov edx, dword [0x6d6b00]
sar eax, 4
sar edx, 4
cmp word [0x6d6fb6], 0
mov dword [0xce984c], eax
mov dword [0xce9874], edx
je 0x507472
mov ecx, dword [0x6d6c28]
mov eax, dword [0x6d6c2c]
sar ecx, 4
sub ecx, 0x64
sar eax, 4
mov dword [0xce8c74], ecx
sub eax, 0x4b
jmp 0x50747e
lea ecx, [eax - 0x64]
lea eax, [edx - 0x4b]
mov dword [0xce8c74], ecx
test ecx, ecx
mov dword [0xce8f30], eax
jge 0x50748f
xor ecx, ecx
mov dword [0xce8c74], ecx
mov edx, dword [0xcea2b4]
add edx, 0xffffff37
cmp ecx, edx
jle 0x5074a7
mov ecx, edx
mov dword [0xce8c74], ecx
test eax, eax
jge 0x5074b2
xor eax, eax
mov dword [0xce8f30], eax
mov edx, dword [0xcea2b8]
add edx, 0xffffff69
cmp eax, edx
jle 0x5074c9
mov eax, edx
mov dword [0xce8f30], eax
mov edx, dword [0x675a54]
mov dword [0x675a54], 0x330
mov dword [0xce8ed0], edx
mov edx, dword [0x675a58]
mov dword [0xce9860], edx
mov edx, dword [0x675a5c]
mov dword [0xce8d5c], edx
mov edx, dword [0x675a60]
mov dword [0xce9858], edx
mov edx, dword [0xa4f1e4]
mov dword [0x675a5c], 0x19
mov dword [0x675a58], 0x3f8
mov dword [0x675a60], 0xaf
push edx
mov edx, dword [esi]
push edx
mov edx, 0x19
sub edx, eax
mov eax, 0x330
sub eax, ecx
push edx
push eax
call dword [0xd36aac]
mov ecx, dword [0xa4f1fc]
mov eax, dword [0xa4f200]
mov edi, dword [0xce8c74]
mov edx, dword [ecx]
mov ecx, dword [0xa4f1f8]
push edx
push eax
mov edx, dword [ecx]
mov eax, dword [0xce9874]
mov ecx, dword [0xce984c]
push edx
mov edx, dword [0xce8f30]
sub ecx, edi
sub eax, edx
add ecx, 0x319
add eax, 3
push eax
push ecx
call dword [0xd36ac8]
mov eax, dword [0x6d6214]
add esp, 0x24
test eax, eax
je 0x5076f0
mov eax, dword [0xa4f1ec]
test eax, eax
je 0x5076f0
mov ecx, dword [0x6d620c]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [esp + 0x10], eax
je 0x50763f
mov eax, dword [eax + 0x10]
test eax, eax
je 0x507624
mov ecx, dword [eax]
cmp ecx, 0x4000
jb 0x507624
cmp ecx, 0x5fff
ja 0x507624
cmp dword [eax + 0x250], ebp
je 0x507624
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x507624
mov edx, dword [0xa4f1f0]
mov ecx, dword [0xa4f1ec]
mov edi, dword [0xce8f30]
push edx
mov edx, dword [ecx]
mov ecx, dword [eax + 0x358]
push edx
mov edx, dword [eax + 0x340]
sar ecx, 4
sub ecx, edi
mov edi, dword [0xce8c74]
sar edx, 4
sub edx, edi
add ecx, 0x19
add edx, 0x330
push ecx
push edx
call dword [0xd36aac]
add esp, 0x10
lea ecx, [esp + 0x10]
call fcn.0044ea10
mov ecx, dword [0x6d620c]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jne 0x5075b6
mov eax, dword [0xa24694]
test eax, eax
je 0x5076f0
xor esi, esi
xor edi, edi
lea eax, [esi + esi*4]
shl eax, 3
sub eax, esi
mov ecx, dword [eax + 0xa246cc]
lea eax, [eax + 0xa246cc]
test ecx, ecx
jne 0x507673
mov ecx, dword [eax + 0x27]
add eax, 0x27
inc esi
test ecx, ecx
je 0x507668
cmp edi, dword [0xa24694]
jge 0x5076f0
mov eax, dword [esi*4 + 0xa246b0]
test eax, eax
je 0x5076e5
lea ecx, [esi + esi*4]
shl ecx, 3
sub ecx, esi
mov edx, dword [ecx + 0xa246d2]
mov ecx, dword [0x6d67ac]
cmp edx, ecx
jne 0x5076e5
mov ecx, dword [esi*4 + 0xa4f22c]
mov edx, dword [esi*4 + 0xa4f214]
mov ebx, dword [0xce8f30]
push ecx
mov ecx, dword [edx]
mov edx, dword [eax + 0x358]
mov eax, dword [eax + 0x340]
push ecx
sar edx, 4
sub edx, ebx
mov ebx, dword [0xce8c74]
sar eax, 4
sub eax, ebx
add edx, 0x19
add eax, 0x330
push edx
push eax
call dword [0xd36aac]
add esp, 0x10
inc edi
inc esi
cmp esi, 6
jl 0x507650
mov ecx, dword [0xce8ed0]
mov eax, dword [0xce9860]
mov edx, dword [0xce8d5c]
mov dword [0x675a54], ecx
mov ecx, dword [0xce9858]
mov dword [0x675a58], eax
mov eax, dword [0xcfa63c]
mov dword [0x675a5c], edx
mov edx, dword [0xcfa640]
mov dword [0x675a60], ecx
mov ecx, dword [eax + 8]
push edx
push ecx
push 0
push 0xe0
call dword [0xd36aac]
mov edx, dword [0xcea2ac]
mov ecx, dword [0xcea2a8]
push 0xc8
mov eax, dword [edx]
mov edx, dword [0xcea2a4]
push eax
push ecx
mov eax, dword [edx]
push eax
push 0
push 0xe0
call dword [0xd36acc]
add esp, 0x28
lea ecx, [esp + 0x3c]
push 0xae
push 0x3ec
push 0xa2
push 0x3b9
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x6421d8]
xor ebx, ebx
test eax, eax
mov eax, dword [0xa4f274]
jne 0x5077ce
test eax, eax
lea edx, [esp + 0x18]
mov edi, 0x66899c
jne 0x5077aa
mov edi, 0x668990
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, 0xff
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5077fd
test eax, eax
lea edx, [esp + 0x18]
mov edi, 0x668984
jne 0x5077e0
mov edi, 0x668978
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
lea edi, [esp + 0x18]
push ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.005a9050
mov esi, ebx
lea eax, [esp + 0x24]
and esi, 0xffff
push esi
push 0xa2
push 0x3b8
push eax
call fcn.0047af10
push esi
push 0xa2
lea ecx, [esp + 0x3c]
push 0x3ba
push ecx
call fcn.0047af10
push esi
push 0xa1
lea edx, [esp + 0x4c]
push 0x3b9
push edx
call fcn.0047af10
push esi
push 0xa3
lea eax, [esp + 0x5c]
push 0x3b9
push eax
call fcn.0047af10
add esp, 0x4c
lea ecx, [esp + 0x18]
push 0xd0eff7
push 0xa2
push 0x3b9
push ecx
call fcn.0047af10
jmp 0x5078b2
mov eax, dword [0xcfa63c]
mov edx, dword [0xcfa640]
push edx
mov ecx, dword [eax + 4]
push ecx
push 0
push 0xe0
call dword [0xd36aac]
mov eax, dword [0xcff7a8]
xor ebx, ebx
add esp, 0x10
cmp eax, ebx
je 0x507b18
mov ecx, dword [0xcff798]
cmp dword [ecx + 0x148], ebx
je 0x507971
mov edx, dword [0xcff7ac]
mov eax, dword [eax + 0x88]
push edx
push eax
push ebx
push ebx
call dword [0xd36aac]
mov edi, 0x668968
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xa4f274]
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
je 0x507944
mov edi, 0x668958
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0xcf95d4]
mov edx, dword [0xcf95d0]
push 0xff0000
add ecx, 0x1e
push 0x9ff3ff
add edx, 0xffffffec
push ecx
lea eax, [esp + 0x38]
push edx
push eax
call fcn.0047af40
add esp, 0x14
jmp 0x50799c
mov edx, dword [ecx + 0x14c]
mov ecx, dword [0xcff7ac]
cmp edx, ebx
push ecx
je 0x50798a
mov edx, dword [eax + 0x8c]
jmp 0x507990
mov edx, dword [eax + 0x88]
push edx
push ebx
push ebx
call dword [0xd36aac]
add esp, 0x10
mov eax, dword [0xcff798]
cmp dword [eax + 0x19c], ebx
je 0x507abd
mov eax, dword [0x6421d8]
lea edx, [esp + 0x2c]
cmp eax, ebx
jne 0x507a20
mov edi, 0x668948
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xa4f274]
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
je 0x507a0b
mov edi, 0x668938
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0xcff7a8]
mov ecx, dword [0xcff7ac]
push ecx
mov eax, dword [edx + 0xa8]
jmp 0x507a84
mov edi, 0x668928
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0xa4f274]
and ecx, 3
cmp eax, ebx
rep movsb byte es:[edi], byte [esi]
je 0x507a71
mov edi, 0x668918
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0xcff7a8]
mov ecx, dword [0xcff7ac]
push ecx
mov eax, dword [edx + 0xa0]
push eax
push ebx
push ebx
call dword [0xd36aac]
mov ecx, dword [0xcf95d4]
mov edx, dword [0xcf95d0]
add esp, 0x10
add ecx, 0x1e
add edx, 0xffffffec
lea eax, [esp + 0x2c]
push 0xff0000
push 0x9ff3ff
push ecx
push edx
push eax
call fcn.0047af40
add esp, 0x14
jmp 0x507b18
mov ecx, dword [eax + 0x1a0]
mov eax, dword [0x6421d8]
cmp ecx, ebx
je 0x507aed
mov ecx, dword [0xcff7ac]
mov edx, dword [0xcff7a8]
cmp eax, ebx
push ecx
jne 0x507ae5
mov eax, dword [edx + 0xac]
jmp 0x507b0c
mov eax, dword [edx + 0xa4]
jmp 0x507b0c
mov ecx, dword [0xcff7ac]
mov edx, dword [0xcff7a8]
cmp eax, ebx
push ecx
jne 0x507b06
mov eax, dword [edx + 0xa8]
jmp 0x507b0c
mov eax, dword [edx + 0xa0]
push eax
push ebx
push ebx
call dword [0xd36aac]
add esp, 0x10
mov ecx, dword [0xcf95d4]
mov edx, dword [0xcf95d0]
push ecx
push edx
push 0x66c5a8
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x507c2c
cmp dword [0xcfa608], ebx
jne 0x507b4b
mov dword [0xcfa608], 1
mov ecx, dword [0x66c5b8]
cmp ecx, ebx
jge 0x507b5d
mov dword [0x66c5b8], ebx
jmp 0x507b9b
mov eax, dword [0xcfa604]
cmp eax, ebx
jl 0x507b94
cmp eax, 5
jg 0x507b94
mov edx, dword [0xcf95b8]
push ecx
mov ecx, dword [0xcf95bc]
mov eax, dword [edx + eax*4]
mov edx, dword [0x66c5a8]
push ecx
mov ecx, dword [0x66c5ac]
push eax
push ecx
push edx
call dword [0xd36ae0]
add esp, 0x14
sub dword [0x66c5b8], 0xa
lea eax, [esp + 0x18]
push eax
call fcn.004fe310
mov eax, dword [0xa4f274]
add esp, 4
cmp eax, ebx
je 0x507bbf
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.00586e90
add esp, 8
mov edx, dword [0x66c5a8]
mov eax, dword [0x66c5ac]
push ebx
lea esi, [edx + 2]
lea edi, [eax + 2]
push edi
lea edx, [esp + 0x20]
lea ecx, [esi + 1]
push ecx
push edx
call fcn.0047af10
push ebx
lea eax, [esi - 1]
push edi
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.0047af10
lea edx, [edi + 1]
push ebx
push edx
lea eax, [esp + 0x40]
push esi
push eax
call fcn.0047af10
lea ecx, [edi - 1]
push ebx
push ecx
lea edx, [esp + 0x50]
push esi
push edx
call fcn.0047af10
add esp, 0x40
lea eax, [esp + 0x18]
push 0xd0eff7
push edi
push esi
push eax
call fcn.0047af10
add esp, 0x10
jmp 0x507cf3
mov ecx, dword [0x66c5b8]
cmp ecx, ebx
jge 0x507c3e
xor ecx, ecx
mov dword [0x66c5b8], ecx
mov edx, dword [0xcfa604]
mov eax, dword [0xcfa600]
cmp edx, eax
je 0x507c92
cmp eax, ebx
jl 0x507c92
cmp eax, 5
jg 0x507c92
mov edx, 0xff
sub edx, ecx
mov ecx, dword [0xcf95bc]
push edx
mov edx, dword [0xcf95b8]
push ecx
mov ecx, dword [0x66c5ac]
mov eax, dword [edx + eax*4]
mov edx, dword [0x66c5a8]
push eax
push ecx
push edx
call dword [0xd36ae0]
mov ecx, dword [0x66c5b8]
mov edx, dword [0xcfa604]
add esp, 0x14
cmp edx, ebx
jl 0x507cc8
cmp edx, 5
jg 0x507cc8
mov eax, dword [0xcf95bc]
push ecx
mov ecx, dword [0xcf95b8]
push eax
mov eax, dword [0x66c5ac]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x66c5a8]
push edx
push eax
push ecx
call dword [0xd36ae0]
mov ecx, dword [0x66c5b8]
add esp, 0x14
cmp dword [0xcfa608], ebx
je 0x507cf3
cmp ecx, 0xfa
jge 0x507ce3
add ecx, 5
mov dword [0x66c5b8], ecx
jmp 0x507cf3
mov dword [0x66c5b8], 0xff
mov dword [0xcfa608], ebx
mov eax, dword [0x6d67b0]
lea edx, [esp + 0x50]
push 0xa
push edx
push eax
call fcn.0061d6c5
mov edx, dword [0x6d67b4]
lea ecx, [esp + 0x70]
push 0xa
push ecx
push edx
call fcn.0061d6c5
mov al, byte [0x648701]
push eax
push ebp
push 0x6486dc
push 0xb
push str.Arial
call fcn.005a7f50
lea ecx, [esp + 0x50]
lea edi, [esp + 0x7c]
push ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x80]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.005a9050
mov eax, dword [esp + 0x5c]
mov ecx, 0x3b4
cdq
sub eax, edx
push 0xd0eff7
sar eax, 1
sub ecx, eax
push 8
lea edx, [esp + 0x90]
push ecx
push edx
call fcn.0047af10
add esp, 0x48
lea eax, [esp + 0x24]
lea edi, [esp + 0x64]
or ecx, 0xffffffff
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x6c]
push ecx
call fcn.005a9050
mov eax, dword [esp + 0x30]
push 0xd0eff7
cdq
sub eax, edx
mov edx, 0x3d5
sar eax, 1
sub edx, eax
push 8
lea eax, [esp + 0x78]
push edx
push eax
call fcn.0047af10
mov cl, byte [0x648701]
push ecx
push ebp
push 0x6486dc
push ebp
push str.Arial
call fcn.005a7f50
mov edx, dword [0x6d67ac]
add esp, 0x30
mov ecx, 0xd12058
push edx
call fcn.005888c0
cmp eax, ebx
je 0x507ea8
lea esi, [eax + 0x28]
call fcn.005a44e0
sub eax, dword [0xce9510]
test eax, eax
jle 0x507e6f
call fcn.005a44e0
add eax, 0x7d0
mov dword [0xce9510], eax
mov eax, dword [0x6d67ac]
cmp eax, 0x44c
jne 0x507e6f
cmp dword [0x6d67b0], 0x8e
jle 0x507e6f
mov eax, dword [0x6d67b4]
cmp eax, 0x187
jle 0x507e6f
cmp eax, 0x1c2
jge 0x507e6f
cmp dword [0x6d69f8], ebx
jne 0x507e6f
lea eax, [esp + 0x18]
push 8
push eax
push 0xddb
mov word [esp + 0x26], 9
mov word [esp + 0x28], 0x110
mov word [esp + 0x24], 0x465
mov word [esp + 0x2a], bx
call fcn.004ac410
add esp, 0xc
lea ecx, [esp + 0x24]
mov edi, esi
push ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.005a9050
mov eax, dword [esp + 0x30]
push 0xd0eff7
cdq
sub eax, edx
mov edx, 0x37b
sar eax, 1
sub edx, eax
push 8
push edx
push esi
call fcn.0047af10
add esp, 0x1c
cmp dword [0xcf85ac], ebx
je 0x508012
mov eax, dword [0xa4f1c8]
mov ecx, dword [0xa4f1bc]
push eax
mov eax, dword [0xcf8594]
mov edx, dword [ecx + 0x10]
mov ecx, dword [0xcf8590]
add eax, 0x15b
push edx
add ecx, 0x16c
push eax
push ecx
call dword [0xd36aac]
mov edx, dword [0xcf85f8]
add esp, 0x10
cmp dword [edx + 0x18], ebx
je 0x507f1d
mov eax, dword [0xa4f1c8]
mov ecx, dword [0xa4f1bc]
push eax
mov eax, dword [0xcf8594]
mov edx, dword [ecx + 0x13c]
mov ecx, dword [0xcf8590]
add eax, 0x15b
push edx
add ecx, 0x16c
push eax
push ecx
jmp 0x507f48
mov edx, dword [0xa4f1c8]
mov eax, dword [0xa4f1bc]
push edx
mov edx, dword [0xcf8594]
mov ecx, dword [eax + 0x138]
mov eax, dword [0xcf8590]
add edx, 0x15b
push ecx
add eax, 0x16c
push edx
push eax
call dword [0xd36aac]
mov ecx, dword [0xcf85f8]
add esp, 0x10
cmp dword [ecx + 0x34], ebx
je 0x507f89
mov edx, dword [0xa4f1c8]
mov eax, dword [0xa4f1bc]
push edx
mov edx, dword [0xcf8594]
mov ecx, dword [eax + 0x144]
mov eax, dword [0xcf8590]
add edx, 0x15b
push ecx
add eax, 0x16c
push edx
push eax
jmp 0x507fb7
mov ecx, dword [0xa4f1c8]
mov edx, dword [0xa4f1bc]
push ecx
mov ecx, dword [0xcf8594]
mov eax, dword [edx + 0x140]
mov edx, dword [0xcf8590]
add ecx, 0x15b
push eax
add edx, 0x16c
push ecx
push edx
call dword [0xd36aac]
mov eax, dword [0xa4f274]
add esp, 0x10
cmp eax, ebx
push 0xffff00
je 0x507fed
mov eax, dword [0xcf8594]
mov ecx, dword [0xcf8590]
add eax, 0x199
add ecx, 0x1a1
push eax
push ecx
push 0x668900
jmp 0x50800a
mov edx, dword [0xcf8594]
mov eax, dword [0xcf8590]
add edx, 0x199
add eax, 0x1a1
push edx
push eax
push 0x6688e8
call fcn.0047af10
add esp, 0x10
cmp dword [0xcf95c0], ebx
je 0x508141
mov edx, dword [0xa4f1bc]
mov ecx, dword [0xa4f1c8]
push ecx
mov eax, dword [edx + 0x10]
push eax
push 0x15b
push 0x16c
call dword [0xd36aac]
mov eax, dword [0xa4f274]
add esp, 0x10
cmp eax, ebx
je 0x50808c
lea ecx, [esp + 0x2c]
mov edi, 0x6688d8
push ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x6688d8
call fcn.005a9050
mov eax, dword [esp + 0x38]
push 0xffffff
cdq
sub eax, edx
mov edx, 0x1f4
sar eax, 1
sub edx, eax
push 0x199
push edx
push 0x6688d8
jmp 0x5080cb
lea eax, [esp + 0x2c]
mov edi, 0x6688c8
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x6688c8
call fcn.005a9050
mov eax, dword [esp + 0x38]
mov ecx, 0x1f4
cdq
sub eax, edx
push 0xffffff
sar eax, 1
sub ecx, eax
push 0x199
push ecx
push 0x6688c8
call fcn.0047af10
mov eax, dword [0xce9530]
mov edx, dword [0xa4f1c8]
add esp, 0x1c
cmp eax, ebx
mov eax, dword [0xa4f1bc]
push edx
je 0x5080f0
mov ecx, dword [eax + 0x13c]
jmp 0x5080f6
mov ecx, dword [eax + 0x138]
push ecx
push 0x15b
push 0x16c
call dword [0xd36aac]
mov eax, dword [0xce8ee0]
mov edx, dword [0xa4f1c8]
add esp, 0x10
cmp eax, ebx
mov eax, dword [0xa4f1bc]
push edx
je 0x508127
mov ecx, dword [eax + 0x144]
jmp 0x50812d
mov ecx, dword [eax + 0x140]
push ecx
push 0x15b
push 0x16c
call dword [0xd36aac]
add esp, 0x10
cmp dword [0xce8a64], ebx
je 0x508480
mov eax, dword [0xce8f48]
mov edx, dword [0xce89c8]
push edx
mov ecx, dword [eax]
push ecx
push ebx
push ebx
call dword [0xd36aac]
mov eax, dword [0x667a60]
add esp, 0x10
cmp eax, ebx
je 0x5081d5
xor esi, esi
mov eax, dword [esi*4 + 0xce977c]
mov edx, dword [esi*4 + 0xce8d60]
push edx
mov ecx, dword [eax]
push ecx
push ebx
push ebx
call dword [0xd36aac]
mov eax, dword [esi*4 + 0xce977c]
lea edx, [esi + 0x8000]
push edx
mov ecx, dword [eax]
push ecx
push ebx
push ebx
call dword [0xd36aa4]
add esp, 0x20
inc esi
cmp esi, 0x34
jl 0x508172
mov eax, dword [0xce8f48]
mov edx, dword [0xce89c8]
push edx
mov ecx, dword [eax + 0x14]
push ecx
push 0xb8
push 0xec
call dword [0xd36aac]
mov eax, dword [0xce8ed8]
jmp 0x508238
xor esi, esi
mov eax, dword [esi*4 + 0xce9628]
mov edx, dword [esi*4 + 0xce8c78]
push edx
mov ecx, dword [eax]
push ecx
push ebx
push ebx
call dword [0xd36aac]
mov eax, dword [esi*4 + 0xce9628]
lea edx, [esi + 0x8000]
push edx
mov ecx, dword [eax]
push ecx
push ebx
push ebx
call dword [0xd36aa4]
add esp, 0x20
inc esi
cmp esi, 0x34
jl 0x5081d7
mov eax, dword [0xce8f48]
mov edx, dword [0xce89c8]
push edx
mov ecx, dword [eax + 0x14]
push ecx
push 0xb8
push 0x18b
call dword [0xd36aac]
mov eax, dword [0xce8edc]
mov edx, dword [0xce89c8]
mov ecx, dword [0xce8f48]
push edx
mov edx, dword [ecx + 0x18]
mov ecx, dword [eax*8 + 0x667a6c]
push edx
mov edx, dword [eax*8 + 0x667a68]
push ecx
push edx
call dword [0xd36aac]
mov edx, dword [0xa54618]
xor ecx, ecx
mov cx, word [0xa4f268]
and edx, 0xffff
imul edx, ecx
lea eax, [esp + 0x5c]
push 0xa
push eax
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
add edx, ecx
push edx
call fcn.0061d6c5
push 0xd0eff7
push 0x15d
lea ecx, [esp + 0x70]
push 0x1fc
push ecx
call fcn.0047af10
mov edx, dword [0x6d67ac]
add esp, 0x3c
mov ecx, 0xd12058
push edx
call fcn.005888c0
cmp eax, ebx
je 0x508307
lea esi, [eax + 0x28]
lea eax, [esp + 0x2c]
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.005a9050
mov eax, dword [esp + 0x38]
mov ecx, 0x184
cdq
sub eax, edx
push 0xff
sar eax, 1
sub ecx, eax
push 0x93
push ecx
push esi
call fcn.0047af10
add esp, 0x1c
mov edx, dword [0xce8ab0]
mov ecx, dword [0xce8f48]
mov eax, dword [edx + 0x18]
cmp eax, ebx
mov eax, dword [0xce89c8]
push eax
je 0x508325
mov edx, dword [ecx + 8]
jmp 0x508328
mov edx, dword [ecx + 4]
push edx
push ebx
push ebx
call dword [0xd36aac]
mov eax, dword [0xce8ab0]
mov edx, dword [0xce8f48]
add esp, 0x10
mov ecx, dword [eax + 0x34]
cmp ecx, ebx
mov ecx, dword [0xce89c8]
push ecx
je 0x508352
mov eax, dword [edx + 0x10]
jmp 0x508355
mov eax, dword [edx + 0xc]
push eax
push ebx
push ebx
call dword [0xd36aac]
mov ecx, dword [0xce8ab0]
mov edx, dword [0xce89c8]
add esp, 0x10
mov eax, dword [ecx + 0x50]
cmp eax, ebx
mov eax, dword [0xce8f48]
push edx
je 0x50837f
mov ecx, dword [eax + 0x20]
jmp 0x508382
mov ecx, dword [eax + 0x1c]
push ecx
push ebx
push ebx
call dword [0xd36aac]
mov edx, dword [0xce8ab0]
mov ecx, dword [0xce8f48]
add esp, 0x10
mov eax, dword [edx + 0x6c]
cmp eax, ebx
mov eax, dword [0xce89c8]
push eax
je 0x5083ac
mov edx, dword [ecx + 0x28]
jmp 0x5083af
mov edx, dword [ecx + 0x24]
push edx
push ebx
push ebx
call dword [0xd36aac]
add esp, 0x10
mov ecx, 0x68f0b0
push 0xce9888
call fcn.004255e0
mov eax, dword [0xce8ed8]
mov ecx, dword [0xce8edc]
inc eax
and eax, 0xffff
shl eax, 0x10
inc ecx
and ecx, 0xffff
or eax, ecx
mov ecx, 0x68f0b0
push eax
push 0xce9888
mov dword [0xce98e8], eax
call fcn.00425430
mov edx, dword [0xce9c30]
mov eax, dword [0x6d6790]
add edx, 0x84
cmp eax, edx
jbe 0x508435
mov ecx, dword [0xce9c18]
mov dword [0xce9c30], eax
inc ecx
cmp ecx, 0x1d
mov dword [0xce9c18], ecx
jbe 0x50843b
mov ecx, 0x18
mov dword [0xce9c18], ecx
jmp 0x50843b
mov ecx, dword [0xce9c18]
mov esi, dword [0xce9b60]
push 0xce9888
mov eax, dword [esi + ecx*4]
cdq
sub eax, edx
mov edx, dword [0xa23354]
sar eax, 1
lea eax, [eax + edx - 0x54]
mov dword [0xce9bc8], eax
mov eax, dword [esi + ecx*4]
mov ecx, dword [0xa23358]
cdq
sub eax, edx
sar eax, 1
lea edx, [eax + ecx - 0x158]
mov dword [0xce9be0], edx
call fcn.0045e010
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret