Function at 0x433010
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x4ccbf8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x1c0], esi
mov dword [ebp - 0x170], 0
mov ecx, dword [esi + 0x24]
sub ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x20]
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x168], ecx
xor ecx, ecx
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x164], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1f8], ecx
cmp dword [0x4edef8], ecx
je 0x434596
cmp dword [eax], 0x12345678
jne 0x434596
call fcn.00469bf0
push dword [esi + 0x18]
mov edi, eax
mov dword [ebp - 0x1b4], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov eax, dword [0x4edef8]
mov dword [ebp - 0x1c8], ebx
cmp dword [eax + 0xdd0], 0
je 0x4330d8
push 0
push dword [eax + 0xdcc]
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push ebx
mov dword [ebp - 0x1f8], eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov ecx, dword [ebp - 0x1dc]
push ecx
push dword [ebp - 0x1e8]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [ebp - 0x17c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x4edef8]
mov dword [ebp - 0x208], eax
test dword [ecx + 4], 0x8000
je 0x433119
mov eax, dword [edi + 0x188]
jmp 0x433121
push 4
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0x170]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1bc]
test eax, eax
je 0x43314e
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [0x4edef8]
mov dword [ebp - 0x170], 0x18
test dword [eax + 4], 0x8000
je 0x4333e7
mov ecx, dword [edi + 0x188]
movzx eax, cl
movsd xmm2, qword [0x4a1d58]
mov dword [ebp - 0x170], 0x1a
movd xmm4, eax
shr eax, 0x1f
cvtdq2pd xmm4, xmm4
addsd xmm4, qword [eax*8 + 0x4a12a0]
mov eax, ecx
shr ecx, 0x10
shr eax, 8
movzx eax, al
movd xmm3, eax
shr eax, 0x1f
cvtdq2pd xmm3, xmm3
addsd xmm3, qword [eax*8 + 0x4a12a0]
movzx eax, cl
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x4a12a0]
movaps xmm0, xmm1
mulsd xmm0, xmm2
subsd xmm1, xmm0
movaps xmm0, xmm3
mulsd xmm0, xmm2
cvttsd2si ecx, xmm1
subsd xmm3, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
shl ecx, 8
cvttsd2si eax, xmm3
subsd xmm4, xmm0
or ecx, eax
shl ecx, 8
cvttsd2si eax, xmm4
or ecx, eax
movzx eax, cl
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a12a0]
mov eax, ecx
shr ecx, 0x10
shr eax, 8
movzx eax, al
movsd qword [ebp - 0x1f4], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a12a0]
movzx eax, cl
movsd qword [ebp - 0x200], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4a12a0]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x160]
push eax
movsd qword [ebp - 0x178], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x158], eax
mov eax, dword [0x4edef8]
mov dword [ebp - 0x160], 0
cmp dword [eax + 0xdd0], 0
jne 0x43338c
mov edx, dword [0x4edf08]
test edx, edx
je 0x43338c
mov eax, dword [ebp - 0x15c]
movzx ecx, word [edi + 0x188]
mov dword [ebp - 0x14c], eax
mov eax, ecx
shl eax, 8
and ecx, 0xff00
mov word [ebp - 0x148], ax
movzx eax, byte [edi + 0x18a]
shl ax, 8
mov word [ebp - 0x144], ax
xor eax, eax
mov word [ebp - 0x142], ax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x13c], eax
cvttsd2si eax, qword [ebp - 0x1f4]
mov dword [ebp - 0x150], 0
mov word [ebp - 0x146], cx
shl ax, 8
mov word [ebp - 0x138], ax
cvttsd2si eax, qword [ebp - 0x200]
shl ax, 8
mov word [ebp - 0x136], ax
cvttsd2si eax, qword [ebp - 0x178]
mov dword [ebp - 0x174], 1
shl ax, 8
mov word [ebp - 0x134], ax
xor eax, eax
mov word [ebp - 0x132], ax
mov dword [ebp - 0x178], eax
test ebx, ebx
je 0x4333e0
push eax
push 1
lea eax, [ebp - 0x178]
push eax
push 2
lea eax, [ebp - 0x150]
push eax
push ebx
call edx
jmp 0x4333e0
cvttsd2si eax, qword [ebp - 0x178]
movzx ecx, al
cvttsd2si eax, qword [ebp - 0x200]
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, qword [ebp - 0x1f4]
shl ecx, 8
movzx eax, al
or ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, eax
lea eax, [ebp - 0x160]
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
test edi, edi
je 0x4333e0
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
add dword [ebp - 0x170], 3
mov ecx, dword [ebp - 0x1ec]
mov eax, dword [ecx + 0xc]
mov edi, dword [ecx + 0x14]
mov dword [ebp - 0x1e0], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1b8], eax
and eax, 1
mov dword [ebp - 0x1e4], edi
mov dword [ebp - 0x1d0], eax
call fcn.00469bf0
movsd xmm2, qword [0x4a1d88]
xorps xmm3, xmm3
mov ecx, dword [eax + 0x184]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, edx
movzx esi, cl
shr eax, 0x1f
shr ecx, 0x10
movd xmm0, edx
cvtdq2pd xmm0, xmm0
movzx ecx, cl
movd xmm4, ecx
addsd xmm0, qword [eax*8 + 0x4a12a0]
mov eax, esi
movd xmm5, edx
shr eax, 0x1f
cvtdq2pd xmm4, xmm4
shr edx, 0x1f
cvtpd2ps xmm0, xmm0
cvtdq2pd xmm5, xmm5
cvtps2pd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x4a1df0]
addsd xmm0, qword [eax*8 + 0x4a12a0]
mov eax, ecx
movd xmm6, esi
shr eax, 0x1f
addsd xmm5, qword [edx*8 + 0x4a12a0]
cvtdq2pd xmm6, xmm6
shr esi, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm6, qword [esi*8 + 0x4a12a0]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4a1dc0]
addsd xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm4, qword [ecx*8 + 0x4a12a0]
addsd xmm0, qword [eax*8 + 0x4a12a0]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x4a1d70]
addsd xmm1, xmm0
movsd xmm0, qword [0x4a1e70]
cvttsd2si eax, xmm1
movzx eax, al
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x4a1d68]
addsd xmm1, qword [0x4a1e60]
subsd xmm0, xmm1
movsd xmm1, qword [0x4a1e38]
subsd xmm1, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
maxsd xmm3, xmm1
movsd xmm1, qword [0x4a1e58]
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x4a1de0]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x4a1e48]
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x204], ecx
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
movsd xmm2, qword [0x4a1dc8]
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
movsd xmm1, qword [0x4a1e50]
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm4
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
mov dword [ebp - 0x174], ecx
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm5
mulsd xmm0, xmm2
movzx ecx, al
or ecx, 0x200
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movaps xmm0, xmm6
mulsd xmm0, xmm2
movzx eax, al
or ecx, eax
shl ecx, 8
addsd xmm0, xmm1
subsd xmm0, xmm3
cvttsd2si eax, xmm0
movzx eax, al
or ecx, eax
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x1fc], ecx
je 0x43367d
mov eax, dword [ebp - 0x1b4]
push 0xffffffffffffffe0
push dword [eax + 0x188]
call fcn.00427490
add esp, 8
mov dword [ebp - 0x1bc], eax
jmp 0x4336d0
movsd xmm1, qword [0x4a1e10]
movsd xmm0, qword [0x4a1da0]
mulsd xmm4, xmm1
mulsd xmm5, xmm1
mulsd xmm6, xmm1
addsd xmm4, xmm0
addsd xmm5, xmm0
addsd xmm6, xmm0
cvttsd2si eax, xmm4
movzx ecx, al
cvttsd2si eax, xmm5
or ecx, 0x200
shl ecx, 8
movzx eax, al
or ecx, eax
cvttsd2si eax, xmm6
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [ebp - 0x1bc], ecx
mov esi, dword [ebp - 0x1c0]
xorps xmm0, xmm0
movlpd qword [ebp - 0x1a8], xmm0
movlpd qword [ebp - 0x1a0], xmm0
movlpd qword [ebp - 0x198], xmm0
mov eax, dword [esi + 8]
movlpd qword [ebp - 0x190], xmm0
movlpd qword [ebp - 0x188], xmm0
mov dword [ebp - 0x1ac], 0x11
mov dword [ebp - 0x1b0], 0x30
cmp eax, 0xffffffff
jne 0x433731
lea eax, [ebp - 0x1b0]
push eax
mov eax, dword [ebp - 0x1ec]
push 1
push dword [eax + 4]
jmp 0x43373b
lea ecx, [ebp - 0x1b0]
push ecx
push 0
push eax
push dword [ebp - 0x1e0]
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
test dword [ebp - 0x1a8], 0x800
je 0x433763
test byte [ebp - 0x1a4], 0x10
jne 0x433763
mov eax, 1
jmp 0x433765
xor eax, eax
mov ecx, dword [0x4edef8]
mov edx, dword [ebp - 0x170]
test dword [ecx + 4], 0x8000
je 0x433783
add edx, 2
mov dword [ebp - 0x170], edx
test eax, eax
je 0x4337f6
mov eax, dword [ebp - 0x168]
add eax, 0xfffffffe
mov dword [ebp - 0x160], 2
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], 4
test dword [ecx + 4], 0x8000
je 0x4337df
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x160], edx
push dword [eax + 0xc]
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
jmp 0x434377
push 2
push 6
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x434377
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x158], 0x14
mov dword [ebp - 0x154], 0x13
lea eax, [edx - 0x10]
mov dword [ebp - 0x1cc], 3
sar eax, 1
mov dword [ebp - 0x1d4], eax
lea eax, [edx - 0x14]
sar eax, 1
mov dword [ebp - 0x15c], eax
test dword [ecx + 4], 0x8000
je 0x43386a
push 0
push 1
lea eax, [ebp - 0x160]
mov dword [ebp - 0x1cc], 4
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
inc dword [ebp - 0x154]
mov ecx, dword [0x4edef8]
test byte [ebp - 0x1b8], 2
mov eax, dword [edi + 0x48]
jne 0x433897
test eax, 0x20000
jne 0x433897
mov edx, dword [ebp - 0x1b4]
mov esi, dword [edx + 0x18c]
mov dword [ebp - 0x1d8], esi
mov esi, dword [ebp - 0x1c0]
jmp 0x4338af
mov edx, dword [ebp - 0x1b4]
mov edi, dword [edx + 0x190]
mov dword [ebp - 0x1d8], edi
mov edi, dword [ebp - 0x1e4]
cmp dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1c4], eax
je 0x43399d
test byte [esi + 0xc], 3
mov dword [ebp - 0x1c4], eax
je 0x43399d
test dword [ecx + 4], 0x8000
je 0x4339dc
push dword [ebp - 0x1bc]
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
test byte [ebp - 0x1b8], 2
mov dword [ebp - 0x1f0], eax
je 0x433908
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x433914
push dword [ebp - 0x204]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x1f0]
mov dword [ebp - 0x1c4], eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x1dc]
push 6
push 6
push ecx
mov ecx, dword [ebp - 0x1e8]
add ecx, 0xfffffffe
mov dword [ebp - 0x1f0], eax
push ecx
push 0
push 1
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
test byte [ebp - 0x1b8], 2
push dword [ebp - 0x1c4]
push ebx
je 0x43396d
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x43397a
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x48]
mov ecx, dword [0x4edef8]
mov dword [ebp - 0x1c4], eax
mov edx, dword [ebp - 0x1b4]
cmp dword [edi + 0x40], 0
je 0x433d53
mov eax, dword [ebp - 0x1b8]
test al, 2
je 0x433abe
mov eax, dword [edi + 0x40]
push 1
push dword [ebp - 0x1d4]
add eax, 2
push dword [ebp - 0x1cc]
push ebx
push eax
push dword [ecx + 0xe14]
jmp 0x43401a
push dword [edx + 0x184]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
cmp dword [edi + 0x40], 0
mov dword [ebp - 0x1f0], eax
jne 0x4339fd
test byte [ebp - 0x1b8], 8
je 0x433a13
test dword [ebp - 0x1a8], 0x200
mov dword [ebp - 0x140], 0x15
je 0x433a1d
mov dword [ebp - 0x140], 0
mov ecx, dword [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x138], ecx
mov ecx, dword [ebp - 0x1dc]
push eax
push ebx
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x134], ecx
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [ebp - 0x1f0]
test eax, eax
je 0x433a5f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test byte [ebp - 0x1b8], 2
mov eax, dword [edi + 0x48]
jne 0x433a9b
test eax, 0x20000
jne 0x433a9b
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0x18c]
xor ecx, 0xffffff
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [0x4edef8]
jmp 0x4339a3
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [edx + 0x190]
mov dword [ebp - 0x1d8], ecx
mov ecx, dword [0x4edef8]
jmp 0x4339a3
test dword [ebp - 0x1a8], 0x200
jne 0x433d02
test dword [ecx + 4], 0x8000
je 0x433b74
test al, 8
je 0x433d02
push dword [ebp - 0x1bc]
push 1
push 0
call dword [sym.imp.GDI32.dll_CreatePen]
cmp dword [ebp - 0x1d0], 0
mov esi, eax
mov eax, dword [ebp - 0x1fc]
cmovne eax, dword [ebp - 0x174]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push ebx
mov edi, eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
push 0
push 0
inc ecx
push ecx
mov ecx, dword [ebp - 0x158]
add ecx, 2
push ecx
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push ebx
call dword [sym.imp.GDI32.dll_RoundRect]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edi, dword [ebp - 0x1e4]
jmp 0x433cfc
mov edx, dword [esi + 0x10]
and edx, 1
test al, 8
je 0x433cd4
test edx, edx
jne 0x433cc6
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x154]
mov ebx, eax
sub ecx, dword [ebp - 0x15c]
push 0xffffff
sub ecx, 3
push 0
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 3
push ecx
push 0
call fcn.0042ab00
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
push eax
sub ecx, 3
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 3
push ecx
push 0
call fcn.0042ab00
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov edx, dword [ebp - 0x15c]
sub ecx, edx
mov eax, dword [ebp - 0x158]
sub ecx, 3
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x160]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x15c]
sub eax, edx
mov ecx, dword [ebp - 0x160]
sub eax, 3
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
sub eax, 3
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ecx, dword [0x4edef8]
mov ebx, dword [ebp - 0x1c8]
mov edi, dword [ebp - 0x1e4]
push dword [ecx + 0xddc]
push dword [ecx + 0xde0]
jmp 0x433ce4
test edx, edx
je 0x433d02
push dword [ecx + 0xde0]
push dword [ecx + 0xddc]
movups xmm0, xmmword [ebp - 0x160]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.00431540
add esp, 0x1c
mov ecx, dword [0x4edef8]
mov edx, dword [edi + 0x40]
test edx, edx
je 0x434020
test dword [edi + 0x48], 0x20000
mov esi, dword [ebp - 0x1c0]
je 0x433d23
mov eax, 3
jmp 0x433d2f
test byte [esi + 0x10], 9
mov eax, 0
setne al
push 1
push dword [ebp - 0x1d4]
dec edx
push dword [ebp - 0x1cc]
add eax, edx
push ebx
push eax
push dword [ecx + 0xe14]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
jmp 0x434026
test dword [ebp - 0x1a8], 0x200
je 0x433df2
test byte [ebp - 0x1b8], 2
je 0x433d83
test eax, 0x20000
je 0x433d7b
mov edx, dword [edx + 0x158]
jmp 0x433d89
mov edx, dword [edx + 0x14c]
jmp 0x433d89
mov edx, dword [edx + 0x148]
test byte [ebp - 0x1b8], 8
je 0x433dd7
test byte [esi + 0x10], 1
je 0x433dbc
test dword [ecx + 4], 0x8000
jne 0x433dbc
push 1
push dword [ebp - 0x1d4]
mov eax, 0x2a
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x43401a
push 1
push dword [ebp - 0x1d4]
mov eax, 0x29
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x43401a
push 1
push dword [ebp - 0x1d4]
mov eax, 0x26
push dword [ebp - 0x1cc]
push ebx
push eax
push edx
jmp 0x43401a
test byte [ebp - 0x1b8], 8
je 0x434020
test byte [ebp - 0x1b8], 2
jne 0x433e1d
mov dword [ebp - 0x1c4], eax
test eax, 0x20000
jne 0x433e1d
mov eax, dword [edx + 0x148]
jmp 0x433e37
test dword [ebp - 0x1c4], 0x20000
je 0x433e31
mov eax, dword [edx + 0x158]
jmp 0x433e37
mov eax, dword [edx + 0x14c]
add dword [ebp - 0x15c], 2
add dword [ebp - 0x160], 2
sub dword [ebp - 0x154], 2
sub dword [ebp - 0x158], 2
test dword [ecx + 4], 0x8000
mov dword [ebp - 0x1bc], eax
jne 0x433fd6
test byte [esi + 0x10], 1
jne 0x433fac
mov eax, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call eax
mov ecx, dword [ebp - 0x154]
mov ebx, eax
sub ecx, dword [ebp - 0x15c]
push 0xffffff
sub ecx, 2
push 0
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 2
push ecx
push 0
call fcn.0042ab00
add esp, 0x14
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
call eax
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x15c]
push eax
sub ecx, 2
push 0xffffff
push ecx
mov ecx, dword [ebp - 0x158]
sub ecx, dword [ebp - 0x160]
sub ecx, 2
push ecx
push 0
call fcn.0042ab00
add esp, 0x14
mov edi, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x154]
mov esi, eax
mov edx, dword [ebp - 0x15c]
sub ecx, edx
mov eax, dword [ebp - 0x158]
sub ecx, 2
push 0xee0086
push 0
push 0
push ebx
push ecx
mov ecx, dword [ebp - 0x160]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x15c]
sub eax, edx
mov ecx, dword [ebp - 0x160]
sub eax, 2
push 0x8800c6
push 0
push 0
push ebx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
sub eax, 2
push eax
lea eax, [edx + 2]
push eax
lea eax, [ecx + 2]
push eax
push dword [ebp - 0x1c8]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call eax
mov ecx, dword [0x4edef8]
mov ebx, dword [ebp - 0x1c8]
mov edi, dword [ebp - 0x1e4]
push dword [ecx + 0xddc]
movups xmm0, xmmword [ebp - 0x160]
push dword [ecx + 0xde0]
sub esp, 0x10
mov eax, esp
push ebx
movups xmmword [eax], xmm0
call fcn.00431540
mov ecx, dword [0x4edef8]
add esp, 0x1c
test dword [edi + 0x48], 0x20000
jne 0x433fff
test byte [ebp - 0x1b8], 2
jne 0x433fff
cmp dword [ebp - 0x1d0], 0
je 0x433fff
test dword [ecx + 4], 0x8000
mov eax, 0x28
je 0x434004
mov eax, 0x27
push 1
push dword [ebp - 0x1d4]
push dword [ebp - 0x1cc]
push ebx
push eax
push dword [ebp - 0x1bc]
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov esi, dword [ebp - 0x1c0]
test dword [edi + 0x48], 0x100000
je 0x4340ac
xor ecx, ecx
mov dword [ebp - 0x1bc], edi
mov dword [ebp - 0x1c8], ecx
mov eax, edi
nop
cmp dword [eax], 0
je 0x434095
test dword [edi + 0x48], 0x20000
jne 0x434065
test byte [ebp - 0x1b8], 2
jne 0x434065
test byte [esi + 0x10], 9
mov eax, 0
setne al
jmp 0x43406a
mov eax, 3
push 0xff00ff
push dword [ebp - 0x1d4]
add eax, ecx
push dword [ebp - 0x1cc]
push dword [edi + eax*4]
push ebx
call fcn.004346b0
mov ecx, dword [ebp - 0x1c8]
add esp, 0x14
mov eax, dword [ebp - 0x1bc]
add ecx, 4
add eax, 0x10
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1c8], ecx
cmp ecx, 0x10
jl 0x434040
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
test dword [edi + 0x48], 0x1000000
mov eax, dword [ebp - 0x1b4]
je 0x4340cc
push dword [eax + 0x118]
jmp 0x4340d2
push dword [eax + 0x2f0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1ec]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x434108
lea edx, [ebp - 0x130]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x4340f2
mov esi, dword [ebp - 0x1c0]
jmp 0x43412b
mov esi, dword [ebp - 0x1c0]
lea eax, [ebp - 0x130]
push 0
push 0x12c
push eax
push dword [esi + 8]
push dword [ebp - 0x1e0]
call dword [sym.imp.USER32.dll_GetMenuStringA]
lea eax, [ebp - 0x130]
push 9
push eax
call fcn.0048ca3c
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x43419c
lea eax, [ebp - 0x130]
push 8
push eax
call fcn.0048ca3c
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x43419c
lea eax, [ebp - 0x130]
push 0xb
push eax
call fcn.0048ca3c
add esp, 8
mov dword [ebp - 0x1b4], eax
test eax, eax
jne 0x43419c
lea ecx, [ebp - 0x130]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434185
sub ecx, edx
lea eax, [ebp - 0x130]
add eax, ecx
mov dword [ebp - 0x1b4], eax
test dword [edi + 0x48], 0x20000
jne 0x4341ae
test byte [ebp - 0x1b8], 2
je 0x434213
cmp dword [ebp - 0x1d0], 0
jne 0x434213
mov eax, dword [0x4edef8]
test dword [eax + 4], 0x8000
jne 0x434213
movups xmm0, xmmword [ebp - 0x170]
push 1
push 1
lea eax, [ebp - 0x140]
push eax
movups xmmword [ebp - 0x140], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call eax
mov edx, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
push 0x24
lea eax, [ebp - 0x140]
sub edx, ecx
push eax
push edx
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x24
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 0x1b4]
lea ecx, [ebp - 0x130]
sub eax, ecx
push eax
mov eax, ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
mov ecx, dword [ebp - 0x1b4]
mov al, byte [ecx]
cmp al, 0xb
jne 0x43426f
mov eax, 0x51eb851f
imul dword [ebp - 0x170]
sar edx, 3
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
imul eax, eax, 0x19
mov dword [ebp - 0x170], eax
mov al, byte [ecx]
test al, al
je 0x43436a
sub dword [ebp - 0x168], 0x13
test dword [edi + 0x48], 0x20000
jne 0x434294
test byte [ebp - 0x1b8], 2
je 0x434334
cmp dword [ebp - 0x1d0], 0
jne 0x434334
mov eax, dword [0x4edef8]
test dword [eax + 4], 0x8000
jne 0x434334
movups xmm0, xmmword [ebp - 0x170]
push 1
push 1
lea eax, [ebp - 0x140]
push eax
movups xmmword [ebp - 0x140], xmm0
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push ebx
call eax
mov edx, dword [ebp - 0x1b4]
lea ecx, [edx + 1]
lea eax, [ecx + 1]
mov dword [ebp - 0x174], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4342f1
sub ecx, dword [ebp - 0x174]
xor eax, eax
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x140]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0x1b4]
inc ecx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x434338
sub ecx, edx
xor eax, eax
mov edx, dword [ebp - 0x1b4]
cmp byte [edx], 0xb
setne al
lea eax, [eax*2 + 0x24]
push eax
lea eax, [ebp - 0x170]
push eax
push ecx
lea eax, [edx + 1]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp - 0x1bc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebx
push dword [ebp - 0x1dc]
push dword [ebp - 0x1e8]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x1f8]
test eax, eax
je 0x4343b0
push 0
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectPalette]
push dword [ebp - 0x208]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x17c]
test eax, eax
je 0x4343d5
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4343e3
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp - 0x1d0], 0
mov dword [edi + 0x58], 0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x5c], eax
je 0x434580
mov eax, dword [edi + 0x60]
test eax, eax
je 0x434580
cmp byte [eax], 0
je 0x434580
test dword [edi + 0x48], 0x800000
je 0x434580
mov esi, dword [ebp - 0x1e0]
xor ebx, ebx
lea eax, [ebp - 0x160]
push eax
push ebx
push esi
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
push dword [ebp - 0x15c]
push dword [ebp - 0x160]
push esi
push 0
call dword [sym.imp.USER32.dll_MenuItemFromPoint]
inc ebx
test eax, eax
js 0x434426
lea ecx, [ebp - 0x160]
push ecx
mov ecx, dword [ebp - 0x1ec]
mov ecx, dword [ecx + 4]
sub ecx, eax
push ecx
push esi
push 0
call dword [sym.imp.USER32.dll_GetMenuItemRect]
mov eax, dword [0x4ee178]
mov esi, dword [ebp - 0x1c0]
test eax, eax
jne 0x4344df
cmp dword [0x4ee17c], 0
jne 0x4344df
push 0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
mov edi, eax
mov esi, dword [sym.imp.GDI32.dll_GetPixel]
add ecx, 0xfffffffd
push ecx
push edi
call esi
push dword [ebp - 0x15c]
mov dword [0x4ee178], eax
mov eax, dword [ebp - 0x160]
add eax, 0xfffffffe
push eax
push edi
call esi
push edi
push 0
mov dword [0x4ee17c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [0x4ee178]
mov edi, dword [ebp - 0x1e4]
mov esi, dword [ebp - 0x1c0]
mov edx, dword [edi + 0x60]
mov ecx, edx
mov dword [edi + 0x78], eax
mov eax, dword [0x4ee17c]
mov dword [edi + 0x74], eax
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4344f2
lea eax, [ebp - 0x180]
sub ecx, ebx
push eax
push ecx
push edx
push dword [esi + 0x18]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebp - 0x158]
mov eax, dword [ebp - 0x180]
add ecx, 2
add eax, 5
mov dword [ebp - 0x160], ecx
add eax, ecx
mov dword [ebp - 0x158], eax
mov eax, dword [0x4edef8]
push edi
push dword [eax + 0x10]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x154]
sub eax, edx
push eax
mov eax, dword [ebp - 0x158]
sub eax, ecx
add eax, 5
push eax
push edx
lea eax, [ecx - 5]
push eax
push 0x50000000
push dword [edi + 0x60]
push str.MenuToolTip
push 0x8080084
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [edi + 0x58], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f41c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f41c
mov esp, ebp
pop ebp
ret