Function at 0x467d30
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49878d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x35c
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x8c]
push edi
lea edi, [ecx + 4]
mov eax, edi
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x5c], eax
mov eax, edi
sub eax, dword [esi + 0x90]
mov dword [esp + 0x10], edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x14c], eax
xor eax, eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0x374], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0x154], eax
mov dword [esp + 0x150], eax
mov ecx, dword [esi + 0x204]
lea eax, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x37c], 2
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, esi
call fcn.00464fe0
mov ebx, dword [esi + 0x98]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x37c]
neg eax
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
sub edi, ebx
sub edi, dword [esp + 0x30]
cmp dword [0x4b16f0], 0
mov dword [esp + 0x74], eax
lea edx, [edi + ebx]
lea eax, [ebx + edi]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x78], edi
mov dword [esp + 0xa8], edx
mov dword [esp + 0x13c], eax
mov dword [esp + 0x6c], ebp
je 0x467e7e
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp dword [0x4b16f0], 0
mov ebp, eax
je 0x467e7e
test ebp, ebp
je 0x469f3c
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x6c]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
cmp dword [0x4b16f0], 0
mov dword [esp + 0x18c], eax
je 0x467e7e
test eax, eax
je 0x469d72
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x1b0], eax
cmp byte [0x4b1160], 0
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 5
je 0x468099
call ebx
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [esp + 0x108], eax
call edi
push 5
mov dword [esp + 0x6c], eax
call ebx
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
shl eax, 8
push 5
mov dword [esp + 0x18], eax
call ebx
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx ebx, al
or ebx, dword [esp + 0x14]
push 5
shl ebx, 8
call dword [sym.imp.USER32.dll_GetSysColor]
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, ebx
push eax
mov dword [esp + 0xec], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 5
mov dword [esp + 0x88], eax
call ebx
push eax
mov dword [esp + 0xd0], eax
call edi
push 5
mov dword [esp + 0xd4], eax
call ebx
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
shl eax, 8
push 5
mov dword [esp + 0x18], eax
call ebx
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x14]
push 5
shl eax, 8
mov dword [esp + 0x18], eax
call ebx
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x14]
push eax
mov dword [esp + 0xc0], eax
call edi
push 5
mov dword [esp + 0xe0], eax
call ebx
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xef
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
shl eax, 8
push 5
mov dword [esp + 0x18], eax
call ebx
movzx ecx, ah
imul ecx, ecx, 0xeb
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x14]
push 5
shl eax, 8
mov dword [esp + 0x18], eax
call ebx
movzx ecx, al
imul ecx, ecx, 0xeb
mov eax, 0x80808081
imul ecx
mov eax, dword [0x4b173c]
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx edx, cl
or edx, dword [esp + 0x14]
push edx
push eax
call fcn.00445740
mov ebx, eax
add esp, 8
push ebx
mov dword [esp + 0x100], ebx
call edi
mov dword [esp + 0xd4], eax
mov dword [esp + 0x100], ebx
push ebx
jmp 0x46829b
call ebx
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [esp + 0x108], eax
call edi
push 5
mov dword [esp + 0x6c], eax
call ebx
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
shl eax, 8
push 5
mov dword [esp + 0x18], eax
call ebx
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx ebx, al
or ebx, dword [esp + 0x14]
push 5
shl ebx, 8
call dword [sym.imp.USER32.dll_GetSysColor]
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, ebx
push eax
mov dword [esp + 0xec], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 5
mov dword [esp + 0x88], eax
call ebx
push eax
mov dword [esp + 0xd0], eax
call edi
push 5
mov dword [esp + 0xd4], eax
call ebx
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
shl eax, 8
push 5
mov dword [esp + 0x18], eax
call ebx
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x14]
push 5
shl eax, 8
mov dword [esp + 0x18], eax
call ebx
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x14]
push eax
mov dword [esp + 0xc0], eax
call edi
push 5
mov dword [esp + 0xe0], eax
call ebx
mov ecx, dword [esp + 0xcc]
push ecx
mov dword [esp + 0x100], eax
call edi
push 5
mov dword [esp + 0xd8], eax
call ebx
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
shl eax, 8
push 5
mov dword [esp + 0x18], eax
call ebx
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x14]
push 5
shl eax, 8
mov dword [esp + 0x18], eax
call ebx
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xbc]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x14]
push ecx
mov dword [esp + 0x104], eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
mov dword [esp + 0xc8], eax
call ebx
push eax
call edi
push 0xf
mov dword [esp + 0xdc], eax
call ebx
push eax
call edi
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x7c], ebx
lea edi, [esp + 0x29c]
push edi
push ebx
mov ecx, esi
call fcn.00463770
test eax, eax
je 0x46832f
mov edx, dword [edi + 8]
mov eax, dword [esp + 0xa4]
sub edx, dword [edi]
push 0
add dword [esp + 0x80], edx
push eax
push edi
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [edi + 8]
cmp eax, dword [edi]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x13c]
mov dword [edi + 4], ecx
mov dword [edi + 0xc], edx
jle 0x46832f
mov ecx, dword [esp + 0x6c]
push edi
push ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46833a
mov dword [esp + ebx*4 + 0x158], 1
jmp 0x46833a
mov dword [esp + ebx*4 + 0x158], 0
add ebx, 1
add edi, 0x10
cmp ebx, 0xd
jl 0x4682d0
mov ecx, esi
call fcn.00477ee0
test eax, eax
jne 0x468369
cmp dword [0x4b16f0], eax
je 0x469d61
cmp dword [esi + 0x22c], 1
jne 0x469d39
xor edi, edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], edi
push 0x400
lea ecx, [esp + 0x44]
mov byte [esp + 0x378], 6
call fcn.0047be00
mov edx, dword [esi + 0x94]
push edx
call fcn.0043bc60
mov eax, dword [esi + 0x94]
push eax
call fcn.00440a70
mov ecx, dword [esi + 0x70]
add esp, 8
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, esi
mov dword [esp + 0x1a0], eax
call fcn.00464f70
cmp dword [0x4b16f0], edi
mov dword [esp + 0x20], eax
je 0x46840d
mov edx, dword [esp + 0x50]
mov ebx, dword [esp + 0x380]
neg edx
push edx
push edi
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
push ebx
push ebp
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x468411
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
cmp eax, dword [esp + 0xa8]
mov dword [esp + 0x3c], edi
jge 0x469a76
jmp 0x468434
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x20]
mov ecx, esi
call fcn.00477ee0
cmp ebx, eax
jge 0x469a76
cmp ebx, dword [esi + 0x220]
jne 0x46847d
mov ecx, dword [esp + 0xfc]
mov edx, dword [esp + 0x100]
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0xd4]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
jmp 0x4684eb
and ebx, 1
je 0x46848f
mov edx, dword [esp + 0x104]
mov dword [esp + 0x48], edx
jmp 0x46849a
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x48], eax
test ebx, ebx
je 0x4684ab
mov ecx, dword [esp + 0xe8]
mov dword [esp + 0x4c], ecx
jmp 0x4684b6
mov edx, dword [esp + 0xbc]
mov dword [esp + 0x4c], edx
test ebx, ebx
je 0x4684c7
mov eax, dword [esp + 0x84]
mov dword [esp + 0x24], eax
jmp 0x4684d2
mov ecx, dword [esp + 0xdc]
mov dword [esp + 0x24], ecx
test ebx, ebx
je 0x4684e0
mov edx, dword [esp + 0x68]
mov dword [esp + 0x1c], edx
jmp 0x4684eb
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x20]
push 0x100
push 0
push 0
push ebx
mov ecx, esi
call fcn.00478a00
add eax, 1
push eax
lea ecx, [esp + 0x68]
call fcn.0047be40
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
push ecx
push edx
push ebx
mov ecx, esi
call fcn.00478a00
push 0x20000
push 0
push 0
push ebx
mov ecx, esi
mov dword [esp + 0x68], eax
call fcn.00478ab0
add eax, 1
push eax
lea ecx, [esp + 0x90]
call fcn.0047be40
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
push eax
push ecx
push ebx
mov ecx, esi
call fcn.00478ab0
mov ebx, dword [esp + 0x8c]
mov ecx, eax
test ecx, ecx
mov eax, dword [esp + 0x64]
mov dword [esp + 0x98], ecx
jne 0x468586
mov edx, dword [esp + 0x58]
push edx
push eax
push ecx
push ecx
call fcn.0047a610
add esp, 0x10
jmp 0x4685c6
push eax
push 0
push 0
call fcn.0047a8d0
mov edi, eax
mov eax, dword [esp + 0x98]
push eax
push 0
push 0
call fcn.0047a8d0
mov ecx, dword [esp + 0xb0]
mov bl, byte [ebx + ecx - 1]
add esp, 0x18
add edi, eax
cmp bl, 0x5c
je 0x4685c0
cmp bl, 0x2f
je 0x4685c0
add edi, 1
mov eax, edi
mov edi, dword [esp + 0x3c]
push 0x100
add eax, 1
push eax
lea ecx, [esp + 0x98]
call fcn.0047be40
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x98]
push eax
mov eax, dword [esp + 0x94]
push ecx
mov ecx, dword [esp + 0x9c]
call fcn.00463fb0
mov edx, dword [esp + 0x2c]
add esp, 0xc
mov ebx, eax
push edx
mov ecx, esi
mov dword [esp + 0x194], ebx
mov byte [esp + 0x130], 0
call fcn.00478d60
test eax, eax
jne 0x46863c
cmp dword [esp + 0x160], eax
je 0x46863c
or byte [esp + 0x12c], 1
cmp dword [esp + 0x170], 0
je 0x46864e
or byte [esp + 0x12c], 2
cmp dword [esp + 0x174], 0
je 0x468660
or byte [esp + 0x12c], 4
cmp dword [esp + 0x16c], 0
je 0x468672
or byte [esp + 0x12c], 8
cmp dword [esp + 0x178], 0
je 0x468684
or byte [esp + 0x12c], 0x10
mov ecx, dword [esp + 0x94]
mov edx, dword [esi + 0x94]
push 1
push 0
lea eax, [esp + 0x110]
push eax
push ebx
push ecx
push edx
call fcn.0043c770
mov eax, dword [esp + 0x38]
add esp, 0x18
push eax
mov ecx, esi
call fcn.00478dd0
test eax, eax
je 0x4686cf
mov ecx, dword [esp + 0x94]
mov edx, dword [esi + 0x94]
push ebx
push ecx
push edx
call fcn.00441560
jmp 0x46870a
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.00478d60
test eax, eax
push ebx
je 0x4686f6
mov ecx, dword [esp + 0x98]
mov edx, dword [esi + 0x94]
push ecx
push edx
call fcn.004414a0
jmp 0x46870a
mov eax, dword [esp + 0x98]
mov ecx, dword [esi + 0x94]
push eax
push ecx
call fcn.004415e0
add esp, 0xc
cmp dword [esp + 0x164], 0
mov dword [esp + 0x54], eax
jne 0x468729
cmp dword [esp + 0x168], 0
je 0x4687ca
mov edx, dword [esp + 0x20]
push edx
mov ecx, esi
call fcn.00478d60
xor ebx, ebx
test eax, eax
jne 0x468775
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x58]
add eax, ecx
cmp ecx, eax
mov dword [esp + 0x70], ebx
jae 0x468773
lea ecx, [ecx]
cmp byte [ecx], 0x2e
jne 0x46875e
lea edx, [ecx + 1]
cmp edx, eax
jae 0x46875e
mov ebx, edx
add ecx, 1
cmp ecx, eax
jb 0x468750
test ebx, ebx
mov dword [esp + 0x70], ebx
je 0x468773
sub eax, ebx
mov ebx, eax
jmp 0x468775
xor ebx, ebx
cmp dword [esp + 0x164], 0
je 0x468791
mov ecx, dword [esp + 0x70]
push ebx
push ecx
lea ecx, [esp + 0xe8]
call fcn.0047bfe0
cmp dword [esp + 0x168], 0
je 0x4687ca
test ebx, ebx
je 0x4687a7
sub dword [esp + 0x70], 1
add ebx, 1
mov edx, dword [esp + 0x20]
push edx
mov ecx, esi
call fcn.00478d60
mov ecx, dword [esp + 0x70]
push eax
lea eax, [esp + 0xf4]
push eax
push ebx
push ecx
call fcn.004644c0
add esp, 0x10
cmp byte [0x4b1684], 0
je 0x4687ff
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x60]
push edx
push ebx
mov ecx, esi
call fcn.00478b60
mov dword [esp + 0x58], eax
lea eax, [esp + 0x88]
push eax
push ebx
mov ecx, esi
call fcn.00478be0
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0x29c]
mov eax, dword [esp + 0x2a4]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x25c], ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x25c]
mov dword [esp + 0x264], eax
lea eax, [edi + ecx]
push edx
push ebp
mov dword [esp + 0x268], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x270], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x468e1c
mov eax, dword [esp + 0x20]
cmp eax, dword [esi + 0x224]
jne 0x46889a
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call ebx
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0xa4], eax
call ebx
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x80], eax
jmp 0x468977
push eax
mov ecx, esi
call fcn.00478150
test eax, eax
je 0x46891f
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x204]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
jne 0x4688ec
push 0xd
call ebx
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0xa4], eax
call ebx
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x9c], eax
jmp 0x468970
push 0xf
call ebx
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
mov dword [esp + 0xa4], eax
call ebx
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x80], edx
jmp 0x468977
cmp dword [esi + 0x1d4], 0
mov eax, dword [esp + 0x4c]
je 0x468930
mov eax, dword [esp + 0x48]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
push 8
mov dword [esp + 0xa4], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x1d4], 0
mov dword [esp + 0x9c], eax
jne 0x46896c
mov eax, dword [esp + 0x24]
mov dword [esp + 0x80], eax
jmp 0x468977
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x29c]
mov eax, dword [esi + 0x90]
mov edx, dword [esp + 0x14c]
mov ebx, dword [esp + 0x20]
add ecx, 4
mov dword [esp + 0xac], ecx
add ecx, eax
add edx, edi
mov dword [esp + 0xb4], ecx
add eax, edx
push ebx
mov ecx, esi
mov dword [esp + 0xb4], edx
mov dword [esp + 0xbc], eax
call fcn.00478150
test eax, eax
jne 0x4689cc
cmp ebx, dword [esi + 0x224]
je 0x4689cc
xor edx, edx
jmp 0x4689d1
mov edx, 1
cmp dword [esi + 0x1d4], 0
mov ecx, dword [esp + 0x4c]
je 0x4689e2
mov ecx, dword [esp + 0x48]
mov eax, dword [esi + 0x90]
push edx
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0xb4]
push edx
push eax
push eax
mov eax, dword [esp + 0xc4]
push eax
push ecx
push ebp
call fcn.00440910
mov eax, dword [esp + 0x2bc]
mov edx, dword [esi + 0x90]
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x4c], eax
lea eax, [edx + eax + 4]
add esp, 0x20
cmp dword [esi + 0x1d4], 0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], ebx
je 0x468a40
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0x34]
push edx
push ebp
call fcn.00449680
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp eax, dword [esi + 0x210]
jne 0x468ab0
cmp dword [esi + 0x1d4], 0
mov ecx, dword [esi + 0x90]
mov edx, dword [esp + 0x29c]
lea eax, [ecx + edx + 4]
mov ecx, dword [esp + 0x2a4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebx
je 0x468a9c
mov eax, dword [esp + 0x1c]
push eax
lea edx, [esp + 0x30]
push edx
push ebp
call fcn.00449630
add esp, 0xc
jmp 0x468e1c
mov eax, dword [esi + 0x90]
mov ecx, dword [esp + 0x29c]
lea edx, [eax + ecx + 6]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x2a4]
mov dword [esp + 0x2c], edx
mov edx, dword [esi + 0x8c]
add eax, edi
add edx, edi
cmp byte [0x4b1684], 0
push 0
mov dword [esp + 0xf0], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x68]
lea eax, [esp + 0x30]
push 0xc20
je 0x468b18
push 0
push eax
push ecx
push edx
push ebp
mov ecx, esi
call fcn.00464680
jmp 0x468b24
push eax
push ecx
push edx
push ebp
call fcn.00461340
add esp, 0x18
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
mov ebx, dword [esi + 0x90]
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x30]
lea edx, [ebx + eax]
mov dword [esp + 0xf8], eax
mov dword [esp + 0x54], eax
lea eax, [edx + 0xc]
cmp eax, dword [esi + 0x164]
mov dword [esp + 0x198], ecx
jle 0x468b60
mov dword [esi + 0x164], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a4]
lea edx, [edx + eax + 6]
xor eax, eax
add ecx, 0xfffffffd
cmp edx, ecx
setg al
mov edi, eax
test edi, edi
mov eax, dword [esp + 0x29c]
je 0x468bf8
mov edx, dword [esp + 0xec]
lea eax, [ebx + eax + 6]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x8c]
add eax, dword [esp + 0x3c]
cmp byte [0x4b1684], 0
push 0
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x30]
push 0x8c20
je 0x468bd9
push 0
push ecx
push edx
push eax
push ebp
mov ecx, esi
call fcn.00464680
jmp 0x468be5
push ecx
push edx
push eax
push ebp
call fcn.00461340
add esp, 0x18
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esi + 0x90]
mov ebx, dword [esp + 0x198]
add eax, ecx
mov ecx, dword [esp + 0x2a4]
lea edx, [eax + 6]
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0xec]
add ecx, 0xfffffffd
add ebx, edx
cmp byte [0x4b1684], 0
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], ebx
je 0x468cca
add eax, 4
mov dword [esp + 0x1bc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c0], eax
mov eax, dword [esp + 0x2a4]
cmp ecx, eax
mov dword [esp + 0x1c4], ecx
jle 0x468c74
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0x18]
neg edi
push 0
sbb edi, edi
and edi, 0x8000
or edi, 0x820
push edi
lea ecx, [esp + 0x1c4]
push ecx
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0xb8]
push edx
push eax
push ecx
push ebp
mov ecx, esi
mov dword [esp + 0x1e4], ebx
call fcn.00464680
mov edx, dword [esp + 0xac]
mov eax, dword [esp + 0x54]
add eax, edx
mov dword [esp + 0xb4], eax
jmp 0x468d10
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x64]
neg edi
sbb edi, edi
push 0
and edi, 0x8000
or edi, 0x820
push edi
lea ecx, [esp + 0xb4]
push ecx
push edx
push eax
push ebp
call fcn.00461340
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x30]
add esp, 0x18
add edx, ecx
mov dword [esp + 0xb4], edx
mov ecx, dword [esp + 0x29c]
mov eax, dword [esi + 0x90]
lea edx, [eax + ecx + 4]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0xf8]
add eax, edx
lea eax, [eax + ecx + 0xc]
mov ecx, dword [esp + 0x2a4]
cmp eax, ecx
mov dword [esp + 0x34], eax
jle 0x468d45
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0xb0]
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x34]
push eax
push ebp
mov dword [esp + 0x48], ebx
call fcn.00449680
mov edi, dword [esp + 0x30]
add esp, 0x10
cmp edi, dword [esi + 0x20c]
jne 0x468da7
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x204]
jne 0x468da7
imul edi, dword [esp + 0x10]
push edi
mov ecx, esi
call fcn.00464fe0
push eax
push 0
lea ecx, [esp + 0x38]
push ecx
push ebp
call fcn.00446030
add esp, 0x14
mov edx, dword [esi + 0x90]
add edx, dword [esp + 0xf8]
cmp dword [esi + 0x1d4], 0
mov eax, dword [esp + 0x29c]
lea ecx, [edx + eax + 0xc]
mov eax, dword [esp + 0x2a4]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ebx
je 0x468deb
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
call fcn.00449630
mov edx, dword [esp + 0xa8]
add esp, 0xc
push edx
push ebp
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esp + 0xa0]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edi, dword [esp + 0x3c]
cmp dword [esp + 0x15c], 0
je 0x468ec7
mov ecx, dword [esp + 0x2ac]
mov eax, dword [esp + 0x2b4]
sub eax, ecx
lea edx, [esp + 0x23c]
add eax, ecx
mov dword [esp + 0x23c], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x248], edi
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x468ec7
mov eax, dword [esi + 0x1d4]
cmp eax, 1
mov ecx, dword [esp + 0x4c]
je 0x468ec1
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
movsx edx, byte [0x4b1684]
mov ebx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x9c]
push 0
push edx
mov edx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x20]
push ebx
push edx
push edi
lea edx, [esp + 0x2c8]
push edx
push 1
push ecx
push eax
push ebp
mov ecx, esi
call fcn.00464bb0
jmp 0x468ecb
mov eax, dword [esp + 0x24]
jmp 0x468e86
mov ebx, dword [esp + 0x5c]
cmp dword [esp + 0x160], 0
je 0x468fab
mov ecx, dword [esp + 0x2bc]
mov eax, dword [esp + 0x2c4]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x1cc], ecx
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0x18]
push ecx
push ebp
mov dword [esp + 0x1d8], edi
mov dword [esp + 0x1e0], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x468fab
test byte [esp + 0x12c], 1
je 0x468f50
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
call fcn.0047b0c0
add esp, 0x10
jmp 0x468f67
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
push 0x49998a
push eax
push ecx
call fcn.00434df0
add esp, 0xc
mov ecx, dword [esi + 0x1d4]
cmp ecx, 2
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
je 0x469115
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 1
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x2d8]
push eax
push 2
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x164], 0
je 0x469054
mov ecx, dword [esp + 0x2cc]
mov eax, dword [esp + 0x2d4]
sub eax, ecx
lea edx, [esp + 0x27c]
add eax, ecx
mov dword [esp + 0x27c], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x288], edi
mov dword [esp + 0x28c], eax
mov dword [esp + 0x290], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x469054
mov eax, dword [esi + 0x1d4]
cmp eax, 3
mov ecx, dword [esp + 0x4c]
je 0x46911e
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0xe0]
push 0
push 0
push edx
mov edx, dword [esp + 0xf0]
push edx
mov edx, dword [esp + 0x20]
push ebx
push edx
push edi
lea edx, [esp + 0x2e8]
push edx
push 3
push ecx
push eax
push ebp
mov ecx, esi
call fcn.00464bb0
lea ecx, [esp + 0xe0]
call fcn.0047c080
cmp dword [esp + 0x168], 0
je 0x46917e
mov ecx, dword [esp + 0x2dc]
mov eax, dword [esp + 0x2e4]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x1ec], ecx
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x1f4], eax
mov eax, dword [esp + 0x18]
push ecx
push ebp
mov dword [esp + 0x1f8], edi
mov dword [esp + 0x200], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46917e
mov ecx, dword [esp + 0xf4]
test ecx, ecx
je 0x46912d
mov eax, dword [esi + 0x1d4]
cmp eax, 4
mov ebx, dword [esp + 0x4c]
je 0x469127
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x1c]
cmp byte [ecx], 0
mov eax, ecx
je 0x4690dc
add eax, 1
cmp byte [eax], 0
jne 0x4690d4
push 0
push 0
sub eax, ecx
push eax
mov eax, dword [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edi
lea eax, [esp + 0x2f8]
push eax
push 4
push ebx
push edx
push ebp
mov ecx, esi
call fcn.00464bb0
lea ecx, [esp + 0xf0]
call fcn.0047c080
mov ebx, dword [esp + 0x5c]
jmp 0x46917e
mov ecx, dword [esp + 0x24]
jmp 0x468f86
mov eax, dword [esp + 0x24]
jmp 0x469019
mov edx, dword [esp + 0x24]
jmp 0x4690cd
cmp dword [esi + 0x1d4], 4
mov eax, dword [esp + 0x24]
je 0x46913e
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2e4]
mov ecx, dword [esp + 0x2dc]
mov dword [esp + 0x254], edx
push eax
lea edx, [esp + 0x250]
mov dword [esp + 0x250], ecx
mov ecx, dword [esp + 0x1c]
push edx
push ebp
mov dword [esp + 0x25c], edi
mov dword [esp + 0x264], ecx
call fcn.00449630
add esp, 0xc
cmp dword [esp + 0x170], 0
je 0x46925e
mov ecx, dword [esp + 0x2fc]
mov eax, dword [esp + 0x304]
sub eax, ecx
mov dword [esp + 0x20c], ecx
add ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x214], ecx
lea ecx, [esp + 0x20c]
push ecx
push ebp
mov dword [esp + 0x218], edi
mov dword [esp + 0x220], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46925e
test byte [esp + 0x12c], 2
je 0x469203
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
call fcn.0047bce0
add esp, 0x10
jmp 0x46921a
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
push 0x49998a
push eax
push ecx
call fcn.00434df0
add esp, 0xc
mov ecx, dword [esi + 0x1d4]
cmp ecx, 6
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
je 0x4692e3
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x318]
push eax
push 6
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x174], 0
je 0x469347
mov ecx, dword [esp + 0x30c]
mov eax, dword [esp + 0x314]
sub eax, ecx
mov dword [esp + 0x28c], ecx
add ecx, eax
lea edx, [esp + 0x28c]
mov dword [esp + 0x294], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x298], edi
mov dword [esp + 0x2a0], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x469347
test byte [esp + 0x12c], 4
je 0x4692ec
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
call fcn.0047bce0
add esp, 0x10
jmp 0x469303
mov ecx, dword [esp + 0x24]
jmp 0x469239
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push 0x49998a
push ecx
push edx
call fcn.00434df0
add esp, 0xc
mov ecx, dword [esi + 0x1d4]
cmp ecx, 7
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
je 0x4693cc
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x328]
push eax
push 7
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x16c], 0
je 0x469430
mov ecx, dword [esp + 0x2ec]
mov eax, dword [esp + 0x2f4]
sub eax, ecx
mov dword [esp + 0x22c], ecx
add ecx, eax
lea edx, [esp + 0x22c]
mov dword [esp + 0x234], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x238], edi
mov dword [esp + 0x240], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x469430
test byte [esp + 0x12c], 8
je 0x4693d5
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x48]
push ecx
push edx
push eax
call fcn.0047bce0
add esp, 0x10
jmp 0x4693ec
mov ecx, dword [esp + 0x24]
jmp 0x469322
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push 0x49998a
push ecx
push edx
call fcn.00434df0
add esp, 0xc
mov ecx, dword [esi + 0x1d4]
cmp ecx, 5
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
je 0x4694aa
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x308]
push eax
push 5
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x178], 0
je 0x46950e
mov ecx, dword [esp + 0x31c]
mov eax, dword [esp + 0x324]
sub eax, ecx
mov dword [esp + 0x26c], ecx
add ecx, eax
lea edx, [esp + 0x26c]
mov dword [esp + 0x274], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x278], edi
mov dword [esp + 0x280], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46950e
test byte [esp + 0x12c], 0x10
je 0x4694b3
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
push eax
push ecx
push edx
call fcn.004522e0
jmp 0x4694c7
mov ecx, dword [esp + 0x24]
jmp 0x46940b
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
push 0x49998a
push eax
push ecx
call fcn.00434df0
mov ecx, dword [esi + 0x1d4]
mov edx, dword [esp + 0x58]
add esp, 0xc
cmp ecx, 8
mov dword [esp + 0x28], eax
je 0x46959b
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x338]
push eax
push 8
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x17c], 0
je 0x4695ea
mov ecx, dword [esp + 0x32c]
mov eax, dword [esp + 0x334]
sub eax, ecx
mov dword [esp + 0x1dc], ecx
add ecx, eax
lea edx, [esp + 0x1dc]
mov dword [esp + 0x1e4], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x1e8], edi
mov dword [esp + 0x1f0], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4695ea
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1a8]
push eax
push ecx
mov ecx, esi
call fcn.00478f00
test eax, eax
je 0x4695a4
mov eax, dword [esp + 0x1a8]
cdq
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x4c]
push edx
push eax
call fcn.00452130
add esp, 0x10
jmp 0x4695a6
mov ecx, dword [esp + 0x24]
jmp 0x4694e9
xor eax, eax
mov ecx, dword [esi + 0x1d4]
cmp ecx, 9
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
je 0x4696d6
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 1
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x348]
push eax
push 9
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x180], 0
je 0x469725
mov ecx, dword [esp + 0x33c]
mov eax, dword [esp + 0x344]
sub eax, ecx
mov dword [esp + 0x1fc], ecx
add ecx, eax
lea edx, [esp + 0x1fc]
mov dword [esp + 0x204], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebp
mov dword [esp + 0x208], edi
mov dword [esp + 0x210], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x469725
lea eax, [esp + 0x1ac]
push eax
lea ecx, [esp + 0x198]
push ecx
mov ecx, dword [esp + 0x198]
lea edx, [esp + 0x1ac]
push edx
mov edx, dword [esp + 0xa0]
lea eax, [esp + 0xd4]
push eax
push ecx
push edx
call fcn.00403640
mov ecx, dword [esp + 0x1c4]
mov edx, dword [esp + 0x1ac]
add esp, 0x18
lea eax, [esp + 0x150]
push eax
mov eax, dword [esp + 0x1a8]
push ecx
mov ecx, dword [esp + 0xd0]
push edx
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00478d60
push eax
call fcn.004153b0
add esp, 0x18
test eax, eax
je 0x4696df
mov ecx, dword [eax + 5]
mov edx, dword [eax + 1]
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
call fcn.0047bce0
add esp, 0x10
jmp 0x4696e1
mov ecx, dword [esp + 0x24]
jmp 0x4695c5
xor eax, eax
mov ecx, dword [esi + 0x1d4]
cmp ecx, 0xa
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
je 0x4697be
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
lea eax, [esp + 0x358]
push eax
push 0xa
push edx
push ecx
push ebp
mov ecx, esi
call fcn.00464bb0
cmp dword [esp + 0x184], 0
je 0x469822
mov ecx, dword [esp + 0x34c]
mov eax, dword [esp + 0x354]
mov edx, dword [esp + 0x3c]
sub eax, ecx
mov dword [esp + 0x21c], ecx
add ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x224], ecx
lea ecx, [esp + 0x21c]
push ecx
push ebp
mov dword [esp + 0x228], edx
mov dword [esp + 0x230], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x469822
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1b4]
push edx
push eax
mov ecx, esi
call fcn.00478e40
test eax, eax
je 0x4697c7
mov ecx, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1b4]
push ecx
push edx
lea eax, [esp + 0x30]
push str._I64d
push eax
call fcn.004532c0
add esp, 0x10
mov edi, eax
jmp 0x4697cd
mov ecx, dword [esp + 0x24]
jmp 0x469700
xor edi, edi
mov dword [esp + 0x28], edi
mov eax, dword [esi + 0x1d4]
cmp eax, 0xb
mov ecx, dword [esp + 0x4c]
je 0x4698b4
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
push 0
push 0
push edx
mov edx, dword [esp + 0x68]
push edi
push edx
mov edx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x54]
push edx
lea edx, [esp + 0x368]
push edx
push 0xb
push ecx
push eax
push ebp
mov ecx, esi
call fcn.00464bb0
test edi, edi
je 0x469822
push edi
call fcn.004455d0
add esp, 4
xor edi, edi
cmp dword [esp + 0x188], edi
je 0x46991a
mov ecx, dword [esp + 0x35c]
mov eax, dword [esp + 0x364]
mov edx, dword [esp + 0x3c]
sub eax, ecx
mov dword [esp + 0x130], ecx
add ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x138], ecx
lea ecx, [esp + 0x130]
push ecx
push ebp
mov dword [esp + 0x13c], edx
mov dword [esp + 0x144], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46991a
mov eax, dword [esp + 0x20]
lea edx, [esp + 0xc0]
push edx
push eax
mov ecx, esi
call fcn.00478ea0
test eax, eax
je 0x4698bd
mov ecx, dword [esp + 0xc0]
push ecx
lea edx, [esp + 0x2c]
push 0x4a23f4
push edx
call fcn.004532c0
add esp, 0xc
mov edi, eax
jmp 0x4698c1
mov eax, dword [esp + 0x24]
jmp 0x4697e8
mov dword [esp + 0x28], edi
mov eax, dword [esi + 0x1d4]
cmp eax, 0xc
mov ecx, dword [esp + 0x4c]
je 0x469914
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
push 0
push 0
push edx
mov edx, dword [esp + 0x68]
push edi
push edx
mov edx, dword [esp + 0x50]
push ebx
push edx
lea edx, [esp + 0x378]
push edx
push 0xc
push ecx
push eax
push ebp
mov ecx, esi
call fcn.00464bb0
test edi, edi
je 0x46991e
push edi
call fcn.004455d0
add esp, 4
jmp 0x46991e
mov eax, dword [esp + 0x24]
jmp 0x4698d8
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x3c]
add eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x30]
push eax
push ebp
mov dword [esp + 0x44], ecx
call fcn.00449630
add esp, 0xc
cmp dword [0x4b16f0], 0
je 0x469a52
cmp dword [esi + 0x22c], 1
jne 0x469a17
lea ecx, [esi + 0x154]
push ecx
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, esi
call fcn.00464f70
imul eax, ebx
mov ecx, dword [esi + 0x98]
mov edi, dword [esp + 0x50]
sub ecx, eax
sub ecx, edi
push ecx
mov ecx, esi
call fcn.00464fe0
neg eax
push eax
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, esi
call fcn.00464e60
test eax, eax
mov ecx, esi
je 0x4699ec
call fcn.00464f70
imul eax, ebx
sub eax, edi
add eax, dword [esi + 0x98]
mov ecx, esi
push eax
call fcn.00464fe0
push eax
push 0
lea eax, [esp + 0x38]
push eax
push ebp
call fcn.00449dc0
add esp, 0x14
jmp 0x469a1b
call fcn.00464f70
imul eax, ebx
sub eax, edi
add eax, dword [esi + 0x98]
mov ecx, esi
push eax
call fcn.00464fe0
push eax
push 0
lea ecx, [esp + 0x38]
push ecx
push ebp
call fcn.00446030
add esp, 0x14
jmp 0x469a1b
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x6c]
push 0xcc0020
push 0
push 0
push ebp
push ebx
push edx
push edi
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [0x4b16f0], 0
je 0x469a56
mov ecx, ebx
neg ecx
push ecx
push 0
push ebp
call dword [sym.imp.GDI32.dll_OffsetClipRgn]
jmp 0x469a5e
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], edx
add dword [esp + 0x20], 1
add edi, ebx
cmp edi, dword [esp + 0xa8]
mov dword [esp + 0x50], edi
jl 0x468430
cmp dword [0x4b16f0], 0
je 0x469cd6
cmp dword [esi + 0x22c], 1
jne 0x469cd6
mov eax, dword [esp + 0xa8]
cmp dword [esp + 0x50], eax
jge 0x469cd6
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0x10]
add ecx, edx
mov dword [esp + 0xc0], ecx
mov ecx, dword [esp + 0x3c]
add ecx, eax
neg eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc8], eax
lea esp, [esp]
xor edi, edi
lea ebx, [esp + 0x2a4]
lea esp, [esp]
cmp dword [esp + edi*4 + 0x158], 0
je 0x469b29
cmp dword [esi + 0x1d4], edi
mov edx, dword [ebx - 8]
mov eax, dword [esp + 0x3c]
mov ecx, dword [ebx]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
je 0x469b1a
mov eax, dword [esp + 0x68]
push eax
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.00449630
add esp, 0xc
add edi, 1
add ebx, 0x10
cmp edi, 0xd
jl 0x469ae0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x34], eax
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x1c]
push eax
push ebp
mov dword [esp + 0x44], ecx
call fcn.00449630
add esp, 0xc
lea eax, [esi + 0x154]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov edx, dword [esi + 0x204]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100000
jne 0x469b96
xor ebx, ebx
jmp 0x469bfd
mov ecx, dword [esi + 0x204]
xor eax, eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
lea eax, [esp + 0x130]
push eax
push 0
push ecx
mov dword [esp + 0x13c], 0x1c
mov dword [esp + 0x140], 4
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov ebx, dword [esp + 0x144]
mov ecx, esi
call fcn.00464f70
imul eax, dword [esp + 0x10]
mov edx, dword [esi + 0x98]
mov edi, dword [esp + 0x50]
sub edx, eax
sub edx, edi
push edx
neg ebx
push ebx
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, esi
call fcn.00464e60
test eax, eax
mov ecx, esi
je 0x469c5f
call fcn.00464f70
mov ebx, dword [esp + 0x10]
imul eax, ebx
sub eax, edi
add eax, dword [esi + 0x98]
mov ecx, esi
push eax
call fcn.00464fe0
push eax
push 0
lea ecx, [esp + 0x38]
push ecx
push ebp
call fcn.00449dc0
jmp 0x469c8b
call fcn.00464f70
imul eax, dword [esp + 0x10]
sub eax, edi
add eax, dword [esi + 0x98]
mov ecx, esi
push eax
call fcn.00464fe0
push eax
push 0
lea edx, [esp + 0x38]
push edx
push ebp
call fcn.00446030
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x80]
add esp, 0x14
push 0xcc0020
push 0
push 0
push ebp
push ebx
push eax
push edi
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0xc8]
push edx
push 0
push ebp
call dword [sym.imp.GDI32.dll_OffsetClipRgn]
add edi, ebx
cmp edi, dword [esp + 0xa8]
mov dword [esp + 0x50], edi
jl 0x469ad0
mov eax, dword [esp + 0x1a0]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
call fcn.00440ab0
call fcn.0043bca0
lea ecx, [esp + 0x90]
mov byte [esp + 0x374], 5
call fcn.0047ca90
lea ecx, [esp + 0x40]
mov byte [esp + 0x374], 4
call fcn.0047ca90
lea ecx, [esp + 0x60]
mov byte [esp + 0x374], 3
call fcn.0047ca90
lea ecx, [esp + 0x88]
mov byte [esp + 0x374], 2
call fcn.0047ca90
cmp dword [0x4b16f0], 0
je 0x469d61
mov ecx, dword [esp + 0x1b0]
push ecx
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x18c]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x469d6a
push 0
push ebp
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x78]
cmp dword [0x4b16f0], 0
je 0x469d88
cmp dword [esi + 0x22c], 1
je 0x469edc
xor eax, eax
lea ecx, [esp + 0x2a8]
mov dword [esp + 0x78], eax
mov dword [esp + 0x54], ecx
lea esp, [esp]
cmp dword [esp + eax*4 + 0x158], 0
je 0x469de6
cmp dword [esi + 0x1d4], eax
mov eax, dword [esp + 0x84]
lea edx, [edi + ebx]
mov dword [ecx - 8], ebx
mov dword [ecx], edx
je 0x469dc5
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x58]
add eax, 0xfffffff4
push eax
push ecx
call fcn.00449630
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x84]
add esp, 0xc
add eax, 1
add ecx, 0x10
cmp eax, 0xd
mov dword [esp + 0x78], eax
mov dword [esp + 0x54], ecx
jl 0x469da0
mov eax, dword [esi + 0x204]
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0xa4]
mov ecx, dword [esp + 0x7c]
mov eax, dword [esp + 0x68]
add ecx, edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x3c], ebx
call fcn.00449630
add esp, 0xc
cmp dword [esi + 0x22c], 1
jne 0x469edc
lea eax, [esi + 0x154]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, esi
call fcn.00464f70
mov edi, dword [esp + 0x10]
mov edx, dword [esi + 0x98]
imul eax, edi
sub edx, eax
push edx
mov ecx, esi
call fcn.00464fe0
neg eax
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, esi
call fcn.00464e60
test eax, eax
mov ecx, esi
je 0x469eb5
call fcn.00464f70
imul eax, edi
add eax, dword [esi + 0x98]
mov ecx, esi
push eax
call fcn.00464fe0
push eax
push 0
lea ecx, [esp + 0x38]
push ecx
push ebp
call fcn.00449dc0
jmp 0x469ed9
call fcn.00464f70
imul eax, edi
add eax, dword [esi + 0x98]
mov ecx, esi
push eax
call fcn.00464fe0
push eax
push 0
lea edx, [esp + 0x38]
push edx
push ebp
call fcn.00446030
add esp, 0x14
mov eax, dword [esp + 0xd8]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov edx, dword [esp + 0xc4]
push edx
call esi
mov eax, dword [esp + 0xd4]
push eax
call esi
mov ecx, dword [esp + 0xdc]
push ecx
call esi
mov edx, dword [esp + 0xd0]
push edx
call esi
mov eax, dword [esp + 0x84]
push eax
call esi
mov ecx, dword [esp + 0x68]
push ecx
call esi
cmp dword [0x4b16f0], 0
je 0x469f3c
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x150]
mov byte [esp + 0x374], 1
call fcn.0047ca90
lea ecx, [esp + 0xf0]
mov byte [esp + 0x374], 0
call fcn.0047ca90
lea ecx, [esp + 0xe0]
mov dword [esp + 0x374], 0xffffffff
call fcn.0047ca90
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x368
ret 8