Function at 0x4685f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a1567
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x4d4028]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push esi
push edi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x1e8]
mov dword fs:[0], eax
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x28], edi
call fcn.004900d8
mov eax, dword [eax + 4]
call fcn.0047c037
mov ecx, ebx
call fcn.0044f38f
call fcn.004900d8
call dword [0x4a2084]
mov ecx, dword [eax + 0x370]
mov dword [esp + 0x50], eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 0x298]
mov eax, dword [eax + 0x29c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
lea esi, [ebx + 0x214]
push eax
lea edx, [esp + 0x1c]
mov eax, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x68], esi
call fcn.0045a6a2
mov eax, dword [esi]
push edi
push 1
mov ecx, esi
call dword [eax + 0x174]
push 0xc379
mov ecx, ebx
call fcn.00490168
push edi
push edi
mov ecx, eax
push 0x20000
mov dword [esp + 0x48], ecx
call fcn.0049021c
push edi
push edi
push 0x20000
mov ecx, esi
call fcn.0049021c
lea eax, [ebx + 0x39c4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], edi
je 0x4686e9
push eax
lea ecx, [ebx + 0x1bc]
call dword [0x4a2ea0]
push dword [ebx + 0x1bc]
mov ecx, dword [esp + 0x40]
call fcn.0049016e
mov eax, dword [ebx + 0x1c4]
and eax, 0xf0
xor esi, esi
cmp eax, 0x10
je 0x46872e
cmp eax, 0x20
je 0x468727
cmp eax, 0x30
je 0x468720
cmp eax, 0x40
jne 0x468733
mov esi, 0x6d9d
jmp 0x468733
mov esi, 0x6d9b
jmp 0x468733
mov esi, 0x6d9e
jmp 0x468733
mov esi, 0x6d9c
push edi
lea eax, [ebx + 0xf8]
call fcn.0045173d
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
add eax, 9
push eax
push 0x16
push edi
push esi
lea esi, [ebx + 0x108]
mov dword [ecx], 0xffff00ff
call fcn.0045134e
call fcn.004900d8
mov eax, dword [eax + 4]
lea ecx, [esp + 0x1c]
push ecx
call fcn.0047cf9a
mov eax, dword [eax]
push 1
push edi
lea esi, [ebx + 0x1ec]
push esi
push edi
push eax
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
lea ecx, [esp + 0x1c]
call dword [0x4a2ee8]
push dword [esi]
push edi
push 0x80
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x1f0]
cmp eax, 4
mov dword [ebx + 0x1cc], edi
jg 0x468c28
je 0x468b59
sub eax, edi
je 0x468a20
dec eax
je 0x4688e4
dec eax
je 0x468890
dec eax
jne 0x469080
xor ecx, ecx
inc ecx
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov esi, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0x20]
and edi, 0x10000000
push eax
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 7
push dword [eax]
mov ecx, ebx
push esi
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0x1c]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 2
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov esi, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0x1c]
and edi, 0x10000000
push eax
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 8
push dword [eax]
mov ecx, ebx
push esi
call fcn.0049023a
lea ecx, [esp + 0x18]
jmp 0x469072
xor ecx, ecx
inc ecx
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov esi, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0x24]
and edi, 0x10000000
push eax
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 6
push dword [eax]
mov ecx, ebx
push esi
call fcn.0049023a
lea ecx, [esp + 0x20]
jmp 0x469072
push 2
pop ecx
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xe0]
mov esi, 0x10000000
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 3
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xdc]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 0xa
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xdc]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 4
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xd8]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 0xb
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xec]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 5
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
lea ecx, [esp + 0xe8]
jmp 0x469072
push 3
pop ecx
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xe4]
mov esi, 0x10000000
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
and dword [esp + 0x1f0], 0
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xe0]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 4
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xf4]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 1
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xf0]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 5
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xf8]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 2
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
lea ecx, [esp + 0xf4]
jmp 0x469072
push 4
pop ecx
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xc8]
mov esi, 0x10000000
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 9
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xc4]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 2
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xd0]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0xa
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
lea ecx, [esp + 0xcc]
jmp 0x469072
cmp eax, 5
push 6
pop ecx
je 0x468ecb
cmp eax, ecx
je 0x468ca6
lea ecx, [eax - 7]
cmp ecx, 5
ja 0x469080
xor esi, esi
add eax, 0xfffffff9
js 0x469080
lea eax, [ebx + 0x1fc]
mov dword [esp + 0x14], eax
mov ecx, dword [ebx + 0x1cc]
lea eax, [esi + 0x3e8]
mov dword [ebx + ecx*4 + 0x1d4], eax
mov eax, dword [ebx + 0x1cc]
mov ecx, dword [eax*4 + 0x4d4894]
inc eax
mov dword [ebx + 0x1cc], eax
mov eax, dword [esp + 0x14]
push dword [eax]
push ecx
mov ecx, ebx
call fcn.0049023a
mov eax, dword [ebx + 0x1f0]
add dword [esp + 0x14], 4
inc esi
sub eax, 7
cmp esi, eax
jle 0x468c59
jmp 0x469082
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xd8]
mov esi, 0x10000000
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0xf
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xd4]
call dword [0x4a2ee8]
cmp byte [ebx + 0x1f8], 0
je 0x468d84
mov eax, dword [ebx + 0x1cc]
push 0xc
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xc4]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0x10
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xc0]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 7
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xcc]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0x11
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xc8]
call dword [0x4a2ee8]
cmp byte [ebx + 0x1f9], 0
je 0x468e67
mov eax, dword [ebx + 0x1cc]
push 0xd
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xf0]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0x12
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xec]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 2
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xd4]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0x13
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
lea ecx, [esp + 0xd0]
jmp 0x469072
mov dword [ebx + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0xe8]
mov esi, 0x10000000
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0xb
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0xe4]
call dword [0x4a2ee8]
cmp byte [ebx + 0x1f8], 0
je 0x468fa9
mov eax, dword [ebx + 0x1cc]
push 0xc
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0x8c]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0xc
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0x88]
call dword [0x4a2ee8]
mov eax, dword [ebx + 0x1cc]
push 7
pop ecx
mov dword [ebx + eax*4 + 0x1d4], ecx
mov eax, dword [ebx + 0x1cc]
mov edx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
push ecx
lea eax, [esp + 0x7c]
and edi, esi
push eax
mov dword [esp + 0x1c], edx
call fcn.0046839d
pop ecx
pop ecx
push 0xd
pop esi
mov dword [esp + 0x1f0], esi
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0x78]
call dword [0x4a2ee8]
cmp byte [ebx + 0x1f9], 0
je 0x469080
mov eax, dword [ebx + 0x1cc]
mov dword [ebx + eax*4 + 0x1d4], esi
mov eax, dword [ebx + 0x1cc]
mov ecx, dword [eax*4 + 0x4d4894]
mov edi, dword [ebx + 0x1c4]
inc eax
mov dword [ebx + 0x1cc], eax
lea eax, [esp + 0x40]
push esi
and edi, 0x10000000
push eax
mov dword [esp + 0x1c], ecx
call fcn.0046839d
pop ecx
pop ecx
mov dword [esp + 0x1f0], 0xe
push dword [eax]
mov ecx, ebx
push dword [esp + 0x18]
call fcn.0049023a
lea ecx, [esp + 0x40]
or dword [esp + 0x1f0], 0xffffffff
call dword [0x4a2ee8]
xor edi, edi
mov eax, dword [ebx + 0x1cc]
cmp eax, 6
jge 0x4690af
lea esi, [eax*4 + 0x4d4894]
push dword [esi]
mov ecx, ebx
call fcn.00490168
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x68]
add esi, 4
cmp esi, str.Trace
jl 0x469094
xor esi, esi
cmp dword [ebx + 0x1cc], edi
jle 0x4690fa
lea eax, [ebx + 0x344]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
push ebx
push dword [esi*4 + 0x4d4894]
call fcn.004900a2
mov eax, dword [esp + 0x50]
call fcn.00456193
push 7
push eax
push dword [esp + 0x28]
call fcn.0045823a
add dword [esp + 0x20], 0x7c8
inc esi
cmp esi, dword [ebx + 0x1cc]
jl 0x4690c3
xor cl, cl
xor esi, esi
cmp dword [ebx + 0x1cc], edi
jle 0x46912b
lea eax, [ebx + 0x1d4]
cmp dword [eax], 2
jne 0x469118
mov byte [ebx + 0x1fa], 1
cmp dword [eax], 1
jne 0x46911f
mov cl, 1
inc esi
add eax, 4
cmp esi, dword [ebx + 0x1cc]
jl 0x46910c
cmp byte [ebx + 0x1fa], 0
jne 0x46915c
test cl, cl
jne 0x46915c
push edi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.0049032a
cmp eax, edi
je 0x46915c
push 1
push 0xf060
push dword [eax + 4]
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0xc37b
mov ecx, ebx
call fcn.00490168
mov esi, eax
mov eax, dword [ebx + 0x1f4]
sub eax, edi
mov dword [esp + 0x14], esi
je 0x469239
dec eax
je 0x4691db
dec eax
jne 0x46924b
test dword [ebx + 0x1c4], 0x10000000
je 0x469199
mov eax, str.Dont_ask_me_again
jmp 0x4691be
push edi
push 0x75f1
lea eax, [esp + 0x48]
push eax
call fcn.00403ae0
mov dword [esp + 0x1f0], 0x15
mov eax, dword [eax]
mov dword [esp + 0x28], 2
push eax
mov ecx, esi
call fcn.0049016e
or dword [esp + 0x1f0], 0xffffffff
test byte [esp + 0x28], 2
je 0x46924b
lea ecx, [esp + 0x40]
jmp 0x469231
test dword [ebx + 0x1c4], 0x10000000
je 0x4691ee
mov eax, str.Dont_tell_me_again
jmp 0x469216
push edi
push 0x75f2
lea eax, [esp + 0x80]
push eax
call fcn.00403ae0
mov dword [esp + 0x1f0], 0x14
mov eax, dword [eax]
mov dword [esp + 0x28], 1
push eax
mov ecx, esi
call fcn.0049016e
or dword [esp + 0x1f0], 0xffffffff
test byte [esp + 0x28], 1
je 0x46924b
lea ecx, [esp + 0x78]
call dword [0x4a2ee8]
jmp 0x46924b
mov ecx, dword [esp + 0x64]
push edi
call fcn.0049015c
push edi
mov ecx, esi
call fcn.0049015c
mov eax, dword [ebx + 0x1d0]
cmp eax, dword [ebx + 0x1cc]
jle 0x46925f
mov dword [ebx + 0x1d0], edi
mov eax, dword [esp + 0x3c]
call fcn.00407140
lea ecx, [esp + 0x17c]
push ecx
push 0x5c
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov dword [esp + 0x18c], 0x2bc
mov dword [esp + 0x9c], edi
mov dword [esp + 0x98], vtable.CFont.0
lea eax, [esp + 0x17c]
push eax
mov dword [esp + 0x1f4], 0x16
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
lea ecx, [esp + 0x9c]
call fcn.0049050a
cmp dword [ebx + 0x1cc], edi
jle 0x4692f0
lea esi, [ebx + 0x344]
cmp edi, dword [ebx + 0x1d0]
jne 0x4692e1
lea eax, [esp + 0x98]
push eax
call fcn.00456a45
inc edi
add esi, 0x7c8
cmp edi, dword [ebx + 0x1cc]
jl 0x4692cc
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.00490468
mov dword [esp + 0x1c], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 0xf8], ecx
lea edi, [esp + 0xfc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
cmp dword [ebx + 0x1cc], ecx
mov dword [esp + 0x28], ecx
jle 0x4693ec
lea eax, [ebx + 0x344]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x18]
call dword [0x4a2ef4]
mov byte [esp + 0x1f0], 0x17
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00490162
lea eax, [esp + 0x78]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
lea esi, [esp + 0x44]
call fcn.00407100
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x40]
sub eax, dword [esp + 0x78]
add ecx, 0xa
cmp ecx, eax
jle 0x4693b3
mov eax, dword [esp + 0x84]
sub eax, dword [esp + 0x7c]
push 0x16
push eax
push ecx
xor eax, eax
push eax
push eax
mov dword [esp + edi*4 + 0x10c], ecx
mov ecx, dword [esp + 0x34]
push eax
call fcn.0049017a
jmp 0x4693ba
mov dword [esp + edi*4 + 0xf8], eax
mov eax, dword [esp + edi*4 + 0xf8]
add dword [esp + 0x28], eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1f0], 0x16
call dword [0x4a2ee8]
add dword [esp + 0x20], 0x7c8
inc edi
cmp edi, dword [ebx + 0x1cc]
jl 0x469336
push 0
lea eax, [esp + 0x114]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esp + 0x118]
sub eax, dword [esp + 0x110]
lea esi, [esp + 0x110]
imul eax, eax, 5
lea edi, [esp + 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cdq
movsd dword es:[edi], dword [esi]
and edx, 7
add eax, edx
sar eax, 3
movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [esp + 0x70], eax
call fcn.004904b6
test eax, 0x402000
mov byte [esp + 0x27], 0
je 0x469445
mov byte [esp + 0x27], 1
mov eax, dword [esp + 0x3c]
call fcn.00407140
mov edi, dword [esp + 0x1c]
mov edx, dword [edi]
push eax
mov ecx, edi
mov dword [esp + 0x44], eax
call dword [edx + 0x30]
mov esi, eax
lea eax, [ebx + 0x1bc]
mov edx, dword [eax]
xor ecx, ecx
cmp dword [edx - 0xc], ecx
jne 0x469480
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x4694a1
mov cl, byte [esp + 0x27]
neg cl
sbb ecx, ecx
and ecx, 0x20000
or ecx, 0x2e50
push ecx
lea ecx, [esp + 0x6c]
push ecx
mov ecx, edi
call fcn.00434ca0
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x30]
mov eax, dword [ebx + 0x1cc]
mov esi, dword [esp + 0x70]
imul eax, eax, 6
mov ecx, dword [esp + 0x28]
sub esi, dword [esp + 0x68]
lea edx, [eax + ecx + 6]
cmp esi, edx
jge 0x4694d4
mov edx, dword [esp + 0x68]
add eax, edx
lea eax, [eax + ecx + 6]
mov dword [esp + 0x70], eax
cmp dword [ebx + 0x1f4], 0
je 0x469551
lea ecx, [esp + 0x18]
call dword [0x4a2ef4]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x1f4], 0x18
call fcn.00490162
push edi
lea eax, [esp + 0x1c]
lea esi, [esp + 0x7c]
call fcn.00407100
lea eax, [esp + 0x140]
push eax
push dword [edi + 8]
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x70]
lea eax, [ecx + eax + 5]
mov ecx, dword [esp + 0x68]
sub edx, ecx
cmp edx, eax
jge 0x46953f
add eax, ecx
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1f0], 0x16
call dword [0x4a2ee8]
mov esi, dword [esp + 0x50]
add esi, 0x414
cmp dword [esi], 0
jne 0x46957e
call fcn.004900d8
mov eax, dword [eax + 4]
push 0
push 0x2bc
push esi
push 0xc
lea ecx, [eax + 0x1a0]
pop edx
call fcn.004802c2
push dword [esp + 0x40]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x30]
mov dword [esp + 0x78], eax
lea eax, [ebx + 0x1c0]
push edi
lea esi, [esp + 0x8c]
call fcn.00407100
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call esi
push 0x1e
mov dword [esp + 0x44], eax
call esi
add eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x40]
push dword [esp + 0x78]
lea esi, [eax + ecx + 0xa]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x30]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x68]
sub ecx, eax
cmp ecx, esi
jge 0x4695e0
add esi, eax
mov dword [esp + 0x70], esi
push dword [edi + 4]
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [esp + 0xa0]
push eax
mov eax, dword [esp + 0x40]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0xa0]
sub esi, dword [esp + 0x68]
mov edi, dword [esp + 0xa4]
sub edi, dword [esp + 0xac]
sub esi, dword [esp + 0xa8]
sub edi, dword [esp + 0x6c]
add esi, dword [esp + 0x70]
add edi, dword [esp + 0x74]
cmp esi, 0xffffff38
jge 0x469638
push 0xffffffffffffff9c
pop esi
and dword [esp + 0x18], 0
lea eax, [esp + 0x120]
push eax
push dword [ebx + 0x234]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x130]
push eax
mov eax, dword [esp + 0x18]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x13c]
sub eax, dword [esp + 0x124]
cmp dword [ebx + 0x1f4], 0
mov dword [esp + 0x20], eax
jne 0x46969c
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
call dword [eax + 0x68]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x68]
and dword [esp + 0x20], 0
lea eax, [esp + 0x54]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, edi
sub eax, dword [esp + 0x18]
push 0x16
mov dword [esp + 0x44], eax
mov dword [ebx + 0xe8], eax
mov eax, dword [esp + 0x64]
sub eax, dword [esp + 0x1c]
mov ecx, ebx
sub eax, dword [esp + 0x5c]
mov dword [ebx + 0xec], esi
add eax, edi
push eax
mov eax, dword [esp + 0x64]
sub eax, dword [esp + 0x5c]
add eax, esi
push eax
xor eax, eax
push eax
push eax
push eax
call fcn.0049017a
push 0
push 0
push dword [esp + 0xb4]
push dword [esp + 0x4c]
call fcn.0045bf22
mov eax, dword [esp + 0xbc]
sub eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0x4c]
add esp, 0x10
push 0x16
add eax, edi
push eax
mov eax, esi
sub eax, dword [esp + 0xa8]
xor edi, edi
add eax, dword [esp + 0xb0]
push eax
push edi
push edi
push edi
call fcn.0049017a
cmp dword [ebx + 0x1f4], edi
je 0x46976a
lea eax, [esp + 0x40]
push eax
push dword [ebx + 0x234]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x4c]
sub esi, dword [esp + 0x40]
sub eax, dword [esp + 0x44]
add esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x64]
push 0x16
push eax
push esi
push edi
push edi
push edi
call fcn.0049017a
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x54]
push eax
push dword [ebx + 0x20]
call esi
mov eax, dword [ebx + 0x1cc]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x54]
inc eax
imul eax, eax, 6
add eax, dword [esp + 0x28]
sub edx, ecx
cmp eax, edx
jle 0x4697c2
sub ecx, dword [esp + 0x5c]
push 0x16
add ecx, eax
mov dword [ebx + 0xec], ecx
mov ecx, dword [esp + 0x64]
sub ecx, dword [esp + 0x5c]
push ecx
push eax
push edi
push edi
push edi
mov ecx, ebx
call fcn.0049017a
lea eax, [esp + 0x54]
push eax
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0xb0]
push eax
push dword [ebx + 0x364]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0xb0]
push eax
mov ecx, ebx
call fcn.004901e6
mov ecx, dword [ebx + 0x1cc]
mov eax, dword [esp + 0x5c]
imul ecx, ecx, 6
sub eax, ecx
sub eax, dword [esp + 0x54]
mov dword [esp + 0x1c], edi
sub eax, dword [esp + 0x28]
add eax, 6
cdq
sub eax, edx
mov edx, dword [esp + 0xb4]
mov esi, eax
mov eax, dword [esp + 0x60]
mov ecx, eax
sub ecx, dword [esp + 0x20]
sar esi, 1
sub ecx, dword [esp + 0xbc]
cmp dword [ebx + 0x1cc], edi
lea ecx, [ecx + edx - 0xa]
mov dword [esp + 0x40], ecx
jle 0x469877
lea eax, [ebx + 0x344]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
push 0x15
push edi
push edi
push dword [esp + 0x4c]
push esi
push edi
call fcn.0049017a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0xf8]
add dword [esp + 0x18], 0x7c8
inc eax
cmp eax, dword [ebx + 0x1cc]
lea esi, [esi + ecx + 6]
mov dword [esp + 0x1c], eax
jl 0x46983c
mov eax, dword [esp + 0x60]
cmp dword [esp + 0x20], edi
mov ecx, dword [esp + 0x5c]
je 0x4698cb
sub ecx, dword [esp + 0x54]
sub eax, dword [esp + 0x20]
push 0x15
push edi
sub ecx, 0x14
push ecx
mov ecx, dword [esp + 0x70]
sub eax, 5
push eax
push 0xa
push edi
call fcn.0049017a
mov eax, dword [esp + 0x60]
sub eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x12c]
sub eax, dword [esp + 0x20]
push 0x15
push edi
push edi
lea eax, [eax + ecx - 5]
mov ecx, dword [esp + 0x20]
push eax
push 0xa
push edi
call fcn.0049017a
cmp dword [esp + 0x2c], edi
je 0x469a36
mov eax, dword [esp + 0x50]
cmp byte [eax + 0x335], 0
jne 0x469a36
push ebx
push 1
push 1
push edi
push edi
lea esi, [ebx + 0x98]
push edi
call fcn.0044f83b
lea eax, [ebx + 0x1c0]
push eax
mov eax, esi
call fcn.0044f905
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x37c]
cmp eax, edi
je 0x469aa8
mov esi, vtable.CBitmap.0
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x1f8], 0x19
call fcn.00456313
test eax, eax
jne 0x469957
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1f0], 0x16
mov dword [esp + 0x2c], esi
call fcn.004311e0
jmp 0x469aa8
lea eax, [esp + 0xf8]
push eax
push 0x18
push dword [esp + 0x38]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
lea ecx, [esp + 0x2c]
je 0x469941
mov eax, dword [esp + 0x100]
mov byte [esp + 0x1f0], 0x16
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], esi
call fcn.004311e0
cmp dword [esp + 0x1c], edi
je 0x469aa8
lea eax, [esp + 0x40]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [ebx + 0x1cc], edi
mov dword [esp + 0x18], edi
jle 0x469aa8
mov eax, dword [esp + 0x1c]
shr eax, 1
mov dword [esp + 0x2c], eax
lea esi, [ebx + 0x344]
lea eax, [esp + 0xb0]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0xb0]
push eax
mov ecx, ebx
call fcn.004901e6
mov eax, dword [esp + 0xbc]
sub eax, dword [esp + 0xb4]
push 0x15
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esp + 0x50]
sar ecx, 1
sub eax, ecx
sub eax, dword [esp + 0x30]
push edi
sub eax, dword [esp + 0x4c]
push edi
push eax
push dword [esp + 0xc0]
mov ecx, esi
push edi
call fcn.0049017a
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add esi, 0x7c8
cmp eax, dword [ebx + 0x1cc]
jl 0x4699c7
jmp 0x469aa8
mov eax, dword [esp + 0x50]
cmp dword [eax + 0x370], edi
jbe 0x469a54
push edi
push 1
push edi
push edi
push edi
push edi
lea esi, [ebx + 0x98]
call fcn.0044f83b
lea ecx, [ebx + 0x1c0]
mov eax, dword [ecx]
cmp dword [eax - 0xc], edi
je 0x469a70
push 0x4a3d98
call dword [0x4a2ef0]
test eax, eax
jne 0x469aa8
call fcn.004900d8
mov eax, dword [eax + 4]
lea esi, [esp + 0x2c]
mov ecx, eax
call fcn.00429b50
push eax
lea ecx, [ebx + 0x1c0]
mov byte [esp + 0x1f4], 0x1a
call dword [0x4a2ea0]
mov ecx, esi
mov byte [esp + 0x1f0], 0x16
call dword [0x4a2ee8]
push dword [ebx + 0x1c0]
mov ecx, ebx
call fcn.0049016e
mov eax, dword [ebx + 0x39c0]
cmp dword [eax - 0xc], edi
je 0x469bfd
lea eax, [esp + 0x88]
push eax
mov eax, dword [esp + 0x40]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x88]
push eax
mov ecx, ebx
call fcn.004901e6
mov eax, dword [esp + 0x94]
add dword [esp + 0x94], 0xc
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x54]
push 0xc37e
push ebx
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x90]
push ecx
mov dword [esp + 0x9c], eax
mov eax, dword [ebx + 0x39bc]
lea esi, [ebx + 0x31f4]
mov edx, dword [esi]
push 0x10000000
push eax
mov ecx, esi
call dword [edx + 0x13c]
mov eax, 0xffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x78], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x80]
push eax
call fcn.00458112
lea eax, [ebx + 0x39c0]
push eax
lea ecx, [esp + 0x20]
call dword [0x4a2ec0]
lea eax, [esp + 0x1c]
mov byte [esp + 0x1f0], 0x1b
push eax
lea ecx, [esi + 0x78c]
mov byte [esi + 0x78a], 1
call dword [0x4a2ea0]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1f0], 0x16
call dword [0x4a2ee8]
push dword [ebx + 0x39bc]
mov ecx, esi
call fcn.0049016e
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov byte [esp + 0x1f0], 0x1c
fld1
sub esp, 0x20
fst qword [esp + 0x18]
fstp qword [esp + 0x10]
lea ecx, [ebx + 0x98]
fldz
lea edx, [esp + 0x4c]
fst qword [esp + 8]
fstp qword [esp]
push 0xc37e
call fcn.00409af0
lea esi, [esp + 0x2c]
call fcn.00440760
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov byte [esp + 0x1f0], 0x1d
fld1
sub esp, 0x20
fst qword [esp + 0x18]
fstp qword [esp + 0x10]
lea ecx, [ebx + 0x98]
fldz
lea edx, [esp + 0x4c]
fst qword [esp + 8]
fstp qword [esp]
push 0xc379
call fcn.00409af0
lea esi, [esp + 0x2c]
mov byte [esp + 0x1f0], 0x16
call fcn.00440760
cmp dword [ebx + 0x1f4], edi
je 0x469cee
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov byte [esp + 0x1f0], 0x1e
fldz
sub esp, 0x20
fst qword [esp + 0x18]
fld1
lea edx, [esp + 0x4c]
fst qword [esp + 0x10]
lea ecx, [ebx + 0x98]
fstp qword [esp + 8]
fstp qword [esp]
push 0xc37c
call fcn.00409af0
lea esi, [esp + 0x2c]
call fcn.00440760
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov byte [esp + 0x1f0], 0x1f
fldz
sub esp, 0x20
fst qword [esp + 0x18]
fld1
lea edx, [esp + 0x4c]
fst qword [esp + 0x10]
lea ecx, [ebx + 0x98]
fstp qword [esp + 8]
fstp qword [esp]
push 0xc37b
call fcn.00409af0
lea esi, [esp + 0x2c]
mov byte [esp + 0x1f0], 0x16
call fcn.00440760
cmp dword [ebx + 0x1cc], edi
mov dword [esp + 0x14], edi
jle 0x469d65
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov eax, dword [esp + 0x14]
mov byte [esp + 0x1f0], 0x20
fldz
sub esp, 0x20
fst qword [esp + 0x18]
fstp qword [esp + 0x10]
lea edx, [esp + 0x4c]
fld1
lea ecx, [ebx + 0x98]
fstp qword [esp + 8]
fld qword [0x4b8ba8]
fstp qword [esp]
push dword [eax*4 + 0x4d4894]
call fcn.00409af0
lea esi, [esp + 0x2c]
mov byte [esp + 0x1f0], 0x16
call fcn.00440760
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [ebx + 0x1cc]
jl 0x469cfa
mov eax, dword [ebx + 0x1d0]
imul eax, eax, 0x7c8
lea ecx, [eax + ebx + 0x344]
call fcn.0048ffbe
mov ebx, dword [ebx + 0x1c4]
test ebx, ebx
js 0x469d94
and ebx, 0xf0
push ebx
call dword [sym.imp.USER32.dll_MessageBeep]
or dword [esp + 0x1f0], 0xffffffff
lea ecx, [esp + 0x98]
mov dword [esp + 0x98], vtable.CFont.0
call fcn.004311e0
xor eax, eax
inc eax
mov ecx, dword [esp + 0x1e8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.00490f79
mov esp, ebp
pop ebp
ret