Function at 0x433a80
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4cdbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c0], esi
mov dword [ebp - 0x170], 0
mov ecx, dword [esi + 0x24]
sub ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x20]
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x168], ecx
xor ecx, ecx
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x164], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f8], ecx
cmp dword [0x4eeef8], ecx
je 0x435006
cmp dword [eax], 0x12345678
jne 0x435006
call fcn.0046a660
push dword [esi + 0x18]
mov edi, eax
mov dword [ebp - 0x1b4], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov eax, dword [0x4eeef8]
mov dword [ebp - 0x1c8], ebx
cmp dword [eax + 0xdd0], 0
je 0x433b48
push 0
push dword [eax + 0xdcc]
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebx
mov dword [ebp - 0x1f8], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ecx, dword [ebp - 0x1dc]
push ecx
push dword [ebp - 0x1e8]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [ebp - 0x17c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x4eeef8]
mov dword [ebp - 0x208], eax
test dword [ecx + 4], 0x8000
je 0x433b89
mov eax, dword [edi + 0x188]
jmp 0x433b91
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1bc]
test eax, eax
je 0x433bbe
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x4eeef8]
mov dword [ebp - 0x170], 0x18
test dword [eax + 4], 0x8000
je 0x433e57
mov ecx, dword [edi + 0x188]
movzx eax, cl
movsd xmm2, qword [0x4a1c18]
mov dword [ebp - 0x170], 0x1a
movd xmm4, eax
shr eax, 0x1f
cvtdq2pd xmm4, xmm4
addsd xmm4, qword [eax*8 + 0x4a1160]
mov eax, ecx
shr ecx, 0x10
shr eax, 8
movzx eax, al
movd xmm3, eax
shr eax, 0x1f
cvtdq2pd xmm3, xmm3
addsd xmm3, qword [eax*8 + 0x4a1160]
movzx eax, cl
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x4a1160]
movaps xmm0, xmm1
mulsd xmm0, xmm2
subsd xmm1, xmm0
movaps xmm0, xmm3
mulsd xmm0, xmm2
cvttsd2si ecx, xmm1
subsd xmm3, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
shl ecx, 8
cvttsd2si eax, xmm3
subsd xmm4, xmm0
or ecx, eax
shl ecx, 8
cvttsd2si eax, xmm4
or ecx, eax
movzx eax, cl
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a1160]
mov eax, ecx
shr ecx, 0x10
shr eax, 8
movzx eax, al
movsd qword [ebp - 0x1f4], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a1160]
movzx eax, cl
movsd qword [ebp - 0x200], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a1160]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x160]
push eax
movsd qword [ebp - 0x178], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x158], eax
mov eax, dword [0x4eeef8]
mov dword [ebp - 0x160], 0
cmp dword [eax + 0xdd0], 0
jne 0x433dfc
mov edx, dword [0x4eef08]
test edx, edx
je 0x433dfc
mov eax, dword [ebp - 0x15c]
movzx ecx, word [edi + 0x188]
mov dword [ebp - 0x14c], eax
mov eax, ecx
shl eax, 8
and ecx, 0xff00
mov word [ebp - 0x148], ax
movzx eax, byte [edi + 0x18a]
shl ax, 8
mov word [ebp - 0x144], ax
xor eax, eax
mov word [ebp - 0x142], ax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x13c], eax
cvttsd2si eax, qword [ebp - 0x1f4]
mov dword [ebp - 0x150], 0
mov word [ebp - 0x146], cx
shl ax, 8
mov word [ebp - 0x138], ax
cvttsd2si eax, qword [ebp - 0x200]
shl ax, 8
mov word [ebp - 0x136], ax
cvttsd2si eax, qword [ebp - 0x178]
mov dword [ebp - 0x174], 1
shl ax, 8
mov word [ebp - 0x134], ax
xor eax, eax
mov word [ebp - 0x132], ax
mov dword [ebp - 0x178], eax
test ebx, ebx
je 0x433e50
push eax
push 1
lea eax, [ebp - 0x178]
push eax
push 2
lea eax, [ebp - 0x150]
push eax
push ebx
call edx
jmp 0x433e50
cvttsd2si eax, qword [ebp - 0x178]
movzx ecx, al
cvttsd2si eax, qword [ebp - 0x200]
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, qword [ebp - 0x1f4]
shl ecx, 8
movzx eax, al
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, eax
lea eax, [ebp - 0x160]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
test edi, edi
je 0x433e50
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
add dword [ebp - 0x170], 3
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ecx + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [ebp - 0x1e0], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1b8], eax
and eax, 1
mov dword [ebp - 0x1e4], edi
mov dword [ebp - 0x1d0], eax
call fcn.0046a660
movsd xmm2, qword [0x4a1c48]
xorps xmm3, xmm3
mov ecx, dword [eax + 0x184]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, edx
movzx esi, cl
shr eax, 0x1f
shr ecx, 0x10
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movzx ecx, cl
movd xmm4, ecx
addsd xmm0, qword [eax*8 + 0x4a1160]
mov eax, esi
movd xmm5, edx
shr eax, 0x1f
cvtdq2pd xmm4, xmm4
shr edx, 0x1f
cvtpd2ps xmm0, xmm0
cvtdq2pd xmm5, xmm5
cvtps2pd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x4a1cb0]
addsd xmm0, qword [eax*8 + 0x4a1160]
mov eax, ecx
movd xmm6, esi
shr eax, 0x1f
addsd xmm5, qword [edx*8 + 0x4a1160]
cvtdq2pd xmm6, xmm6
shr esi, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm6, qword [esi*8 + 0x4a1160]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4a1c80]
addsd xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm4, qword [ecx*8 + 0x4a1160]
addsd xmm0, qword [eax*8 + 0x4a1160]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4a1c30]
addsd xmm1, xmm0
movsd xmm0, qword [0x4a1d30]
cvttsd2si eax, xmm1
movzx eax, al
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x4a1c28]
addsd xmm1, qword [0x4a1d20]
subsd xmm0, xmm1
movsd xmm1, qword [0x4a1cf8]
subsd xmm1, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
maxsd xmm3, xmm1
movsd xmm1, qword [0x4a1d18]
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x4a1ca0]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x4a1d08]
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x204], ecx
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x4a1c88]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x4a1d10]
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x174], ecx
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movzx eax, al
or ecx, eax
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x1fc], ecx
je 0x4340ed
mov eax, dword [ebp - 0x1b4]
push 0xffffffffffffffe0
push dword [eax + 0x188]
call fcn.00427ee0
add esp, 8
mov dword [ebp - 0x1bc], eax
jmp 0x434140
movsd xmm1, qword [0x4a1cd0]
movsd xmm0, qword [0x4a1c60]
mulsd xmm4, xmm1
mulsd xmm5, xmm1
mulsd xmm6, xmm1
addsd xmm4, xmm0
addsd xmm5, xmm0
addsd xmm6, xmm0
cvttsd2si eax, xmm4
movzx ecx, al
cvttsd2si eax, xmm5
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, xmm6
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [ebp - 0x1bc], ecx
mov esi, dword [ebp - 0x1c0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1a8], xmm0
movlpd qword [ebp - 0x1a0], xmm0
movlpd qword [ebp - 0x198], xmm0
mov eax, dword [esi + 8]
movlpd qword [ebp - 0x190], xmm0
movlpd qword [ebp - 0x188], xmm0
mov dword [ebp - 0x1ac], 0x11
mov dword [ebp - 0x1b0], 0x30
cmp eax, 0xffffffff
jne 0x4341a1
lea eax, [ebp - 0x1b0]
push eax
mov eax, dword [ebp - 0x1ec]
push 1
push dword [eax + 4]
jmp 0x4341ab
lea ecx, [ebp - 0x1b0]
push ecx
push 0
push eax
push dword [ebp - 0x1e0]
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
test dword [ebp - 0x1a8], 0x800
je 0x4341d3
test byte [ebp - 0x1a4], 0x10
jne 0x4341d3
mov eax, 1
jmp 0x4341d5
xor eax, eax
mov ecx, dword [0x4eeef8]
mov edx, dword [ebp - 0x170]
test dword [ecx + 4], 0x8000
je 0x4341f3
add edx, 2
mov dword [ebp - 0x170], edx
test eax, eax
je 0x434266
mov eax, dword [ebp - 0x168]
add eax, 0xfffffffe
mov dword [ebp - 0x160], 2
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], 4
test dword [ecx + 4], 0x8000
je 0x43424f
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x160], edx
push dword [eax + 0xc]
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x434de7
push 2
push 6
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x434de7
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x158], 0x14
mov dword [ebp - 0x154], 0x13
lea eax, [edx - 0x10]
mov dword [ebp - 0x1cc], 3
sar eax, 1
mov dword [ebp - 0x1d4], eax
lea eax, [edx - 0x14]
sar eax, 1
mov dword [ebp - 0x15c], eax
test dword [ecx + 4], 0x8000
je 0x4342da
push 0
push 1
lea eax, [ebp - 0x160]
mov dword [ebp - 0x1cc], 4
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
inc dword [ebp - 0x154]
mov ecx, dword [0x4eeef8]
test byte [ebp - 0x1b8], 2
mov eax, dword [edi + 0x48]
jne 0x434307
test eax, 0x20000
jne 0x434307
mov edx, dword [ebp - 0x1b4]
mov esi, dword [edx + 0x18c]
mov dword [ebp - 0x1d8], esi
mov esi, dword [ebp - 0x1c0]
jmp 0x43431f
mov edx, dword [ebp - 0x1b4]
mov edi, dword [edx + 0x190]
mov dword [ebp - 0x1d8], edi
mov edi, dword [ebp - 0x1e4]
cmp dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1c4], eax
je 0x43440d
test byte [esi + 0xc], 3
mov dword [ebp - 0x1c4], eax
je 0x43440d
test dword [ecx + 4], 0x8000
je 0x43444c
push dword [ebp - 0x1bc]
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x1f0], eax
je 0x434378
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x434384
push dword [ebp - 0x204]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x1f0]
mov dword [ebp - 0x1c4], eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x1dc]
push 6
push 6
push ecx
mov ecx, dword [ebp - 0x1e8]
add ecx, 0xfffffffe
mov dword [ebp - 0x1f0], eax
push ecx
push 0
push 1
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
test byte [ebp - 0x1b8], 2
push dword [ebp - 0x1c4]
push ebx
je 0x4343dd
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4343ea
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x48]
mov ecx, dword [0x4eeef8]
mov dword [ebp - 0x1c4], eax
mov edx, dword [ebp - 0x1b4]
cmp dword [edi + 0x40], 0
je 0x4347c3
mov eax, dword [ebp - 0x1b8]
test al, 2
je 0x43452e
mov eax, dword [edi + 0x40]
push 1
push dword [ebp - 0x1d4]
add eax, 2
push dword [ebp - 0x1cc]
push ebx
push eax
push dword [ecx + 0xe14]
jmp 0x434a8a
push dword [edx + 0x184]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
cmp dword [edi + 0x40], 0
mov dword [ebp - 0x1f0], eax
jne 0x43446d
test byte [ebp - 0x1b8], 8
je 0x434483
test dword [ebp - 0x1a8], 0x200
mov dword [ebp - 0x140], 0x15
je 0x43448d
mov dword [ebp - 0x140], 0
mov ecx, dword [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x1dc]
push eax
push ebx
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x134], ecx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1f0]
test eax, eax
je 0x4344cf
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test byte [ebp - 0x1b8], 2
mov eax, dword [edi + 0x48]
jne 0x43450b
test eax, 0x20000
jne 0x43450b
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0x18c]
xor ecx, 0xffffff
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [0x4eeef8]
jmp 0x434413
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0x190]
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [0x4eeef8]
jmp 0x434413
test dword [ebp - 0x1a8], 0x200
jne 0x434772
test dword [ecx + 4], 0x8000
je 0x4345e4
test al, 8
je 0x434772
push dword [ebp - 0x1bc]
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
cmp dword [ebp - 0x1d0], 0
mov esi, eax
mov eax, dword [ebp - 0x1fc]
cmovne eax, dword [ebp - 0x174]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
mov edi, eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
push 0
push 0
inc ecx
push ecx
mov ecx, dword [ebp - 0x158]
add ecx, 2
push ecx
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [ebp - 0x1e4]
jmp 0x43476c
mov edx, dword [esi + 0x10]
and edx, 1
test al, 8
je 0x434744
test edx, edx
jne 0x434736
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x154]
mov ebx, eax
sub ecx, dword [ebp - 0x15c]
push 0xffffff
sub ecx, 3
push 0
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 3
push ecx
push 0
call fcn.0042b570
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
push eax
sub ecx, 3
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 3
push ecx
push 0
call fcn.0042b570
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov edx, dword [ebp - 0x15c]
sub ecx, edx
mov eax, dword [ebp - 0x158]
sub ecx, 3
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x160]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x15c]
sub eax, edx
mov ecx, dword [ebp - 0x160]
sub eax, 3
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ecx, dword [0x4eeef8]
mov ebx, dword [ebp - 0x1c8]
mov edi, dword [ebp - 0x1e4]
push dword [ecx + 0xddc]
push dword [ecx + 0xde0]
jmp 0x434754
test edx, edx
je 0x434772
push dword [ecx + 0xde0]
push dword [ecx + 0xddc]
movups xmm0, xmmword [ebp - 0x160]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.00431fb0
add esp, 0x1c
mov ecx, dword [0x4eeef8]
mov edx, dword [edi + 0x40]
test edx, edx
je 0x434a90
test dword [edi + 0x48], 0x20000
mov esi, dword [ebp - 0x1c0]
je 0x434793
mov eax, 3
jmp 0x43479f
test byte [esi + 0x10], 9
mov eax, 0
setne al
push 1
push dword [ebp - 0x1d4]
dec edx
push dword [ebp - 0x1cc]
add eax, edx
push ebx
push eax
push dword [ecx + 0xe14]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
jmp 0x434a96
test dword [ebp - 0x1a8], 0x200
je 0x434862
test byte [ebp - 0x1b8], 2
je 0x4347f3
test eax, 0x20000
je 0x4347eb
mov edx, dword [edx + 0x158]
jmp 0x4347f9
mov edx, dword [edx + 0x14c]
jmp 0x4347f9
mov edx, dword [edx + 0x148]
test byte [ebp - 0x1b8], 8
je 0x434847
test byte [esi + 0x10], 1
je 0x43482c
test dword [ecx + 4], 0x8000
jne 0x43482c
push 1
push dword [ebp - 0x1d4]
mov eax, 0x2a
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x434a8a
push 1
push dword [ebp - 0x1d4]
mov eax, 0x29
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x434a8a
push 1
push dword [ebp - 0x1d4]
mov eax, 0x26
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x434a8a
test byte [ebp - 0x1b8], 8
je 0x434a90
test byte [ebp - 0x1b8], 2
jne 0x43488d
mov dword [ebp - 0x1c4], eax
test eax, 0x20000
jne 0x43488d
mov eax, dword [edx + 0x148]
jmp 0x4348a7
test dword [ebp - 0x1c4], 0x20000
je 0x4348a1
mov eax, dword [edx + 0x158]
jmp 0x4348a7
mov eax, dword [edx + 0x14c]
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
sub dword [ebp - 0x154], 2
sub dword [ebp - 0x158], 2
test dword [ecx + 4], 0x8000
mov dword [ebp - 0x1bc], eax
jne 0x434a46
test byte [esi + 0x10], 1
jne 0x434a1c
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x154]
mov ebx, eax
sub ecx, dword [ebp - 0x15c]
push 0xffffff
sub ecx, 2
push 0
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 2
push ecx
push 0
call fcn.0042b570
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
push eax
sub ecx, 2
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 2
push ecx
push 0
call fcn.0042b570
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov edx, dword [ebp - 0x15c]
sub ecx, edx
mov eax, dword [ebp - 0x158]
sub ecx, 2
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x160]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x15c]
sub eax, edx
mov ecx, dword [ebp - 0x160]
sub eax, 2
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ecx, dword [0x4eeef8]
mov ebx, dword [ebp - 0x1c8]
mov edi, dword [ebp - 0x1e4]
push dword [ecx + 0xddc]
movups xmm0, xmmword [ebp - 0x160]
push dword [ecx + 0xde0]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.00431fb0
mov ecx, dword [0x4eeef8]
add esp, 0x1c
test dword [edi + 0x48], 0x20000
jne 0x434a6f
test byte [ebp - 0x1b8], 2
jne 0x434a6f
cmp dword [ebp - 0x1d0], 0
je 0x434a6f
test dword [ecx + 4], 0x8000
mov eax, 0x28
je 0x434a74
mov eax, 0x27
push 1
push dword [ebp - 0x1d4]
push dword [ebp - 0x1cc]
push ebx
push eax
push dword [ebp - 0x1bc]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov esi, dword [ebp - 0x1c0]
test dword [edi + 0x48], 0x100000
je 0x434b1c
xor ecx, ecx
mov dword [ebp - 0x1bc], edi
mov dword [ebp - 0x1c8], ecx
mov eax, edi
nop
cmp dword [eax], 0
je 0x434b05
test dword [edi + 0x48], 0x20000
jne 0x434ad5
test byte [ebp - 0x1b8], 2
jne 0x434ad5
test byte [esi + 0x10], 9
mov eax, 0
setne al
jmp 0x434ada
mov eax, 3
push 0xff00ff
push dword [ebp - 0x1d4]
add eax, ecx
push dword [ebp - 0x1cc]
push dword [edi + eax*4]
push ebx
call fcn.00435120
mov ecx, dword [ebp - 0x1c8]
add esp, 0x14
mov eax, dword [ebp - 0x1bc]
add ecx, 4
add eax, 0x10
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1c8], ecx
cmp ecx, 0x10
jl 0x434ab0
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
test dword [edi + 0x48], 0x1000000
mov eax, dword [ebp - 0x1b4]
je 0x434b3c
push dword [eax + 0x118]
jmp 0x434b42
push dword [eax + 0x2f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x434b78
lea edx, [ebp - 0x130]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x434b62
mov esi, dword [ebp - 0x1c0]
jmp 0x434b9b
mov esi, dword [ebp - 0x1c0]
lea eax, [ebp - 0x130]
push 0
push 0x12c
push eax
push dword [esi + 8]
push dword [ebp - 0x1e0]
call dword [sym.imp.USER32.dll_GetMenuStringA]
lea eax, [ebp - 0x130]
push 9
push eax
call fcn.0048d4ac
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x434c0c
lea eax, [ebp - 0x130]
push 8
push eax
call fcn.0048d4ac
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x434c0c
lea eax, [ebp - 0x130]
push 0xb
push eax
call fcn.0048d4ac
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x434c0c
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434bf5
sub ecx, edx
lea eax, [ebp - 0x130]
add eax, ecx
mov dword [ebp - 0x1b4], eax
test dword [edi + 0x48], 0x20000
jne 0x434c1e
test byte [ebp - 0x1b8], 2
je 0x434c83
cmp dword [ebp - 0x1d0], 0
jne 0x434c83
mov eax, dword [0x4eeef8]
test dword [eax + 4], 0x8000
jne 0x434c83
movups xmm0, xmmword [ebp - 0x170]
push 1
push 1
lea eax, [ebp - 0x140]
push eax
movups xmmword [ebp - 0x140], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call eax
mov edx, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
push 0x24
lea eax, [ebp - 0x140]
sub edx, ecx
push eax
push edx
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x24
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
sub eax, ecx
push eax
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [ebp - 0x1b4]
mov al, byte [ecx]
cmp al, 0xb
jne 0x434cdf
mov eax, 0x51eb851f
imul dword [ebp - 0x170]
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
imul eax, eax, 0x19
mov dword [ebp - 0x170], eax
mov al, byte [ecx]
test al, al
je 0x434dda
sub dword [ebp - 0x168], 0x13
test dword [edi + 0x48], 0x20000
jne 0x434d04
test byte [ebp - 0x1b8], 2
je 0x434da4
cmp dword [ebp - 0x1d0], 0
jne 0x434da4
mov eax, dword [0x4eeef8]
test dword [eax + 4], 0x8000
jne 0x434da4
movups xmm0, xmmword [ebp - 0x170]
push 1
push 1
lea eax, [ebp - 0x140]
push eax
movups xmmword [ebp - 0x140], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call eax
mov edx, dword [ebp - 0x1b4]
lea ecx, [edx + 1]
lea eax, [ecx + 1]
mov dword [ebp - 0x174], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434d61
sub ecx, dword [ebp - 0x174]
xor eax, eax
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x140]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x1b4]
inc ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434da8
sub ecx, edx
xor eax, eax
mov edx, dword [ebp - 0x1b4]
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x170]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1bc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebx
push dword [ebp - 0x1dc]
push dword [ebp - 0x1e8]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x1f8]
test eax, eax
je 0x434e20
push 0
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x208]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x17c]
test eax, eax
je 0x434e45
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x58]
test eax, eax
je 0x434e53
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp - 0x1d0], 0
mov dword [edi + 0x58], 0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x5c], eax
je 0x434ff0
mov eax, dword [edi + 0x60]
test eax, eax
je 0x434ff0
cmp byte [eax], 0
je 0x434ff0
test dword [edi + 0x48], 0x800000
je 0x434ff0
mov esi, dword [ebp - 0x1e0]
xor ebx, ebx
lea eax, [ebp - 0x160]
push eax
push ebx
push esi
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push esi
push 0
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
inc ebx
test eax, eax
js 0x434e96
lea ecx, [ebp - 0x160]
push ecx
mov ecx, dword [ebp - 0x1ec]
mov ecx, dword [ecx + 4]
sub ecx, eax
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
mov eax, dword [0x4ef178]
mov esi, dword [ebp - 0x1c0]
test eax, eax
jne 0x434f4f
cmp dword [0x4ef17c], 0
jne 0x434f4f
push 0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
mov edi, eax
mov esi, dword [sym.imp.GDI32.dll_GetPixel]
add ecx, 0xfffffffd
push ecx
push edi
call esi
push dword [ebp - 0x15c]
mov dword [0x4ef178], eax
mov eax, dword [ebp - 0x160]
add eax, 0xfffffffe
push eax
push edi
call esi
push edi
push 0
mov dword [0x4ef17c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x4ef178]
mov edi, dword [ebp - 0x1e4]
mov esi, dword [ebp - 0x1c0]
mov edx, dword [edi + 0x60]
mov ecx, edx
mov dword [edi + 0x78], eax
mov eax, dword [0x4ef17c]
mov dword [edi + 0x74], eax
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434f62
lea eax, [ebp - 0x180]
sub ecx, ebx
push eax
push ecx
push edx
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x180]
add ecx, 2
add eax, 5
mov dword [ebp - 0x160], ecx
add eax, ecx
mov dword [ebp - 0x158], eax
mov eax, dword [0x4eeef8]
push edi
push dword [eax + 0x10]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x154]
sub eax, edx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
add eax, 5
push eax
push edx
lea eax, [ecx - 5]
push eax
push 0x50000000
push dword [edi + 0x60]
push str.MenuToolTip
push 0x8080084
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [edi + 0x58], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047fe8c
mov esp, ebp
pop ebp
ret