Function at 0x462e90
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4923ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x310
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x84]
push edi
lea edi, [ecx + 4]
mov eax, edi
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x50], eax
mov eax, edi
sub eax, dword [esi + 0x88]
mov dword [esp + 0x14], edi
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x178], eax
xor eax, eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0x328], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x17c], eax
mov ecx, dword [esi + 0x1e4]
lea eax, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x330], 2
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, esi
call fcn.004600f0
mov ebp, dword [esi + 0x90]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x330]
neg eax
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
sub edi, ebp
sub edi, dword [esp + 0x28]
cmp dword [0x4aa6f8], 0
mov dword [esp + 0x84], eax
lea edx, [edi + ebp]
lea eax, [edi + ebp]
mov dword [esp + 0x4c], ebp
mov dword [esp + 0xf8], edi
mov dword [esp + 0xa8], edx
mov dword [esp + 0x13c], eax
mov dword [esp + 0x70], ebx
je 0x462fe7
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
cmp dword [0x4aa6f8], 0
mov ebx, eax
je 0x462fe7
test ebx, ebx
je 0x464f26
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x84]
mov eax, dword [esp + 0x70]
push ecx
push edx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
cmp dword [0x4aa6f8], 0
mov dword [esp + 0x184], eax
je 0x462fe7
test eax, eax
je 0x464d65
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x1a8], eax
cmp byte [0x4aa150], 0
mov ebp, dword [sym.imp.USER32.dll_GetSysColor]
push 5
je 0x4631f9
call ebp
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [esp + 0x104], eax
call edi
push 5
mov dword [esp + 0x60], eax
call ebp
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
shl eax, 8
push 5
mov dword [esp + 0x14], eax
call ebp
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x10]
push 5
shl eax, 8
mov dword [esp + 0x14], eax
call ebp
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x108], eax
call edi
push 5
mov dword [esp + 0x7c], eax
call ebp
push eax
mov dword [esp + 0xd8], eax
call edi
push 5
mov dword [esp + 0xd0], eax
call ebp
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
shl eax, 8
push 5
mov dword [esp + 0x14], eax
call ebp
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x10]
push 5
shl eax, 8
mov dword [esp + 0x14], eax
call ebp
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x10]
push eax
mov dword [esp + 0xe0], eax
call edi
push 5
mov dword [esp + 0xc8], eax
call ebp
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xef
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
shl eax, 8
push 5
mov dword [esp + 0x14], eax
call ebp
movzx ecx, ah
imul ecx, ecx, 0xeb
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x10]
push 5
shl eax, 8
mov dword [esp + 0x14], eax
call ebp
movzx ecx, al
imul ecx, ecx, 0xeb
mov eax, 0x80808081
imul ecx
mov eax, dword [0x4aa75c]
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx edx, cl
or edx, dword [esp + 0x10]
push edx
push eax
call fcn.00441bd0
add esp, 8
push eax
mov dword [esp + 0xc4], eax
call edi
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xc0]
push eax
jmp 0x4633ed
call ebp
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov dword [esp + 0x104], eax
call edi
push 5
mov dword [esp + 0x60], eax
call ebp
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
shl eax, 8
push 5
mov dword [esp + 0x14], eax
call ebp
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x10]
push 5
shl eax, 8
mov dword [esp + 0x14], eax
call ebp
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x108], eax
call edi
push 5
mov dword [esp + 0x7c], eax
call ebp
push eax
mov dword [esp + 0xd8], eax
call edi
push 5
mov dword [esp + 0xd0], eax
call ebp
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
shl eax, 8
push 5
mov dword [esp + 0x14], eax
call ebp
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x10]
push 5
shl eax, 8
mov dword [esp + 0x14], eax
call ebp
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x10]
push eax
mov dword [esp + 0xe0], eax
call edi
push 5
mov dword [esp + 0xc8], eax
call ebp
mov ecx, dword [esp + 0xd4]
push ecx
mov dword [esp + 0xc4], eax
call edi
push 5
mov dword [esp + 0xc0], eax
call ebp
shr eax, 0x10
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
shl eax, 8
push 5
mov dword [esp + 0x14], eax
call ebp
movzx ecx, ah
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx eax, cl
or eax, dword [esp + 0x10]
push 5
shl eax, 8
mov dword [esp + 0x14], eax
call ebp
movzx ecx, al
imul ecx, ecx, 0xf7
mov eax, 0x80808081
imul ecx
add edx, ecx
mov ecx, dword [esp + 0xdc]
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
or eax, dword [esp + 0x10]
push ecx
mov dword [esp + 0xf0], eax
call edi
push 0xd
mov dword [esp + 0xcc], eax
call ebp
push eax
call edi
push 0xf
mov dword [esp + 0xe4], eax
call ebp
push eax
call edi
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x270]
lea ebx, [ebx]
mov edx, dword [esp + 0x1c]
push edi
push edx
mov ecx, esi
call fcn.0045e8c0
test eax, eax
je 0x4634a8
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x98]
sub eax, dword [edi]
push 0
add dword [esp + 0x84], eax
push ecx
push edi
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, dword [edi + 8]
cmp ecx, dword [edi]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x13c]
mov dword [edi + 4], edx
mov dword [edi + 0xc], eax
jle 0x463497
mov edx, dword [esp + 0x70]
push edi
push edx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4634b7
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x14c], 1
jmp 0x4634b7
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x14c], 0
jmp 0x4634b7
mov edx, dword [esp + 0x1c]
mov dword [esp + edx*4 + 0x14c], 0
mov eax, dword [esp + 0x1c]
add eax, 1
add edi, 0x10
cmp eax, 0xb
mov dword [esp + 0x1c], eax
jl 0x463430
mov ecx, esi
call fcn.004727c0
test eax, eax
jne 0x4634f2
cmp dword [0x4aa6f8], eax
je 0x464d51
cmp dword [esi + 0x20c], 1
jne 0x464d29
xor eax, eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], eax
push 0x400
lea ecx, [esp + 0x3c]
mov byte [esp + 0x32c], 6
call fcn.004762c0
mov eax, dword [esi + 0x8c]
push eax
call fcn.004382c0
mov ecx, dword [esi + 0x8c]
push ecx
call fcn.0043d210
mov edx, dword [esi + 0x68]
add esp, 8
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, esi
mov dword [esp + 0x1ac], eax
call fcn.00460080
cmp dword [0x4aa6f8], 0
mov edi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x40], edi
je 0x4635a9
mov ecx, dword [esp + 0x334]
neg eax
push eax
push 0
push ecx
call dword [sym.imp.GDI32.dll_OffsetRgn]
mov edx, dword [esp + 0x334]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov dword [esp + 0x54], 0
jmp 0x4635ad
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x4c]
cmp ecx, dword [esp + 0xa8]
jge 0x464a64
jmp 0x4635c4
mov edi, dword [esp + 0x40]
mov ecx, esi
call fcn.004727c0
cmp edi, eax
jge 0x464a64
cmp edi, dword [esi + 0x200]
jne 0x463609
mov edx, dword [esp + 0xc0]
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xc8]
mov dword [esp + 0x44], edx
mov edx, dword [esp + 0xbc]
mov dword [esp + 0x48], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], edx
jmp 0x463676
mov eax, edi
and eax, 1
je 0x46361d
mov ecx, dword [esp + 0x100]
mov dword [esp + 0x44], ecx
jmp 0x463628
mov edx, dword [esp + 0xd4]
mov dword [esp + 0x44], edx
test eax, eax
je 0x463639
mov ecx, dword [esp + 0x104]
mov dword [esp + 0x48], ecx
jmp 0x463644
mov edx, dword [esp + 0xdc]
mov dword [esp + 0x48], edx
test eax, eax
je 0x463652
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x34], ecx
jmp 0x46365d
mov edx, dword [esp + 0xc4]
mov dword [esp + 0x34], edx
test eax, eax
je 0x46366b
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
jmp 0x463676
mov ecx, dword [esp + 0xcc]
mov dword [esp + 0x20], ecx
push 0x100
push 0
push 0
push edi
mov ecx, esi
call fcn.00473140
add eax, 1
push eax
lea ecx, [esp + 0x68]
call fcn.00476300
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
push edx
push eax
push edi
mov ecx, esi
call fcn.00473140
push 0x20000
push 0
push 0
push edi
mov ecx, esi
mov dword [esp + 0x2c], eax
call fcn.004731f0
add eax, 1
push eax
lea ecx, [esp + 0x90]
call fcn.00476300
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x8c]
push ecx
push edx
push edi
mov ecx, esi
call fcn.004731f0
test eax, eax
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0xa4], eax
mov dword [esp + 0x68], edx
jne 0x463711
mov eax, dword [esp + 0x1c]
push eax
push ecx
push 0
push 0
call fcn.00474cd0
add esp, 0x10
jmp 0x463756
push ecx
push 0
push 0
call fcn.00474f90
mov ecx, dword [esp + 0x98]
push ecx
push 0
push 0
mov edi, eax
call fcn.00474f90
mov edx, dword [esp + 0x80]
add edi, eax
mov eax, dword [esp + 0xbc]
mov al, byte [edx + eax - 1]
add esp, 0x18
cmp al, 0x5c
je 0x463750
cmp al, 0x2f
je 0x463750
add edi, 1
mov eax, edi
mov edi, dword [esp + 0x40]
push 0x100
add eax, 1
push eax
lea ecx, [esp + 0x98]
call fcn.00476300
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0xa4]
push ecx
mov ecx, dword [esp + 0x94]
push edx
mov edx, dword [esp + 0x9c]
push eax
mov eax, dword [esp + 0x98]
call fcn.0045f0c0
add esp, 0xc
push edi
mov ecx, esi
mov dword [esp + 0x78], eax
mov byte [esp + 0x130], 0
call fcn.004734a0
test eax, eax
jne 0x4637c3
cmp dword [esp + 0x154], eax
je 0x4637c3
or byte [esp + 0x12c], 1
cmp dword [esp + 0x164], 0
je 0x4637d5
or byte [esp + 0x12c], 2
cmp dword [esp + 0x168], 0
je 0x4637e7
or byte [esp + 0x12c], 4
cmp dword [esp + 0x160], 0
je 0x4637f9
or byte [esp + 0x12c], 8
cmp dword [esp + 0x16c], 0
je 0x46380b
or byte [esp + 0x12c], 0x10
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x94]
push 1
push 0
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esi + 0x8c]
push edx
push eax
push ecx
call fcn.00438dc0
add esp, 0x18
push edi
mov ecx, esi
call fcn.004734a0
test eax, eax
je 0x463856
mov edx, dword [esp + 0x74]
mov eax, dword [esp + 0x94]
push edx
push eax
call fcn.0043ce90
add esp, 8
jmp 0x463872
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x94]
mov eax, dword [esi + 0x8c]
push ecx
push edx
push eax
call fcn.0043d970
add esp, 0xc
cmp dword [esp + 0x158], 0
mov dword [esp + 0x58], eax
jne 0x463892
cmp dword [esp + 0x15c], 0
je 0x46392d
mov edi, dword [esp + 0x40]
push edi
mov ecx, esi
call fcn.004734a0
xor edi, edi
test eax, eax
jne 0x4638d8
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x1c]
lea eax, [ecx + edx]
cmp ecx, eax
mov dword [esp + 0x6c], edi
jae 0x4638d6
cmp byte [ecx], 0x2e
jne 0x4638c1
lea edx, [ecx + 1]
cmp edx, eax
jae 0x4638c1
mov edi, edx
add ecx, 1
cmp ecx, eax
jb 0x4638b3
test edi, edi
mov dword [esp + 0x6c], edi
je 0x4638d6
sub eax, edi
mov edi, eax
jmp 0x4638d8
xor edi, edi
cmp dword [esp + 0x158], 0
je 0x4638f4
mov eax, dword [esp + 0x6c]
push edi
push eax
lea ecx, [esp + 0xec]
call fcn.004764a0
cmp dword [esp + 0x15c], 0
je 0x46392d
test edi, edi
je 0x46390a
sub dword [esp + 0x6c], 1
add edi, 1
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, esi
call fcn.004734a0
push eax
mov eax, dword [esp + 0x70]
lea edx, [esp + 0xf4]
push edx
push edi
push eax
call fcn.0045f5d0
add esp, 0x10
cmp byte [0x4aa648], 0
je 0x46396d
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x60]
push ecx
push edi
mov ecx, esi
call fcn.004732a0
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.00473510
test eax, eax
je 0x46396d
lea edx, [esp + 0x88]
push edx
push edi
mov ecx, esi
call fcn.00473320
mov dword [esp + 0xa4], eax
mov ecx, dword [esp + 0x270]
mov eax, dword [esp + 0x278]
mov edi, dword [esp + 0x54]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x230], ecx
mov dword [esp + 0x238], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x230]
add eax, edi
push ecx
push ebx
mov dword [esp + 0x23c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x244], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x463f70
mov edx, dword [esp + 0x40]
cmp edx, dword [esi + 0x204]
jne 0x463a02
push 0xd
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0xa0], eax
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x7c], eax
jmp 0x463acd
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, esi
call fcn.00472a30
test eax, eax
je 0x463a7f
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x1e4]
jne 0x463a4f
push 0xd
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0xa0], eax
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0xe0]
mov dword [esp + 0xa0], eax
jmp 0x463ac9
push 0xf
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
mov dword [esp + 0xa0], eax
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x7c], eax
jmp 0x463acd
cmp dword [esi + 0x1b4], 0
mov eax, dword [esp + 0x48]
je 0x463a90
mov eax, dword [esp + 0x44]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 8
mov dword [esp + 0xa0], eax
call ebp
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x1b4], 0
mov dword [esp + 0xa0], eax
jne 0x463ac5
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x7c], ecx
jmp 0x463acd
mov edx, dword [esp + 0x20]
mov dword [esp + 0x7c], edx
mov ecx, dword [esp + 0x270]
mov eax, dword [esp + 0x178]
lea edx, [edi + eax]
mov eax, dword [esi + 0x88]
add ecx, 4
mov dword [esp + 0xac], ecx
add ecx, eax
add eax, edx
mov dword [esp + 0xb0], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xb4], ecx
push edx
mov ecx, esi
mov dword [esp + 0xbc], eax
call fcn.00472a30
test eax, eax
jne 0x463b27
mov eax, dword [esp + 0x40]
cmp eax, dword [esi + 0x204]
je 0x463b27
xor edx, edx
jmp 0x463b2c
mov edx, 1
cmp dword [esi + 0x1b4], 0
mov ecx, dword [esp + 0x48]
je 0x463b3d
mov ecx, dword [esp + 0x44]
mov eax, dword [esi + 0x88]
push edx
mov edx, dword [esp + 0xb4]
push ecx
mov ecx, dword [esp + 0x60]
push ecx
push eax
push eax
mov eax, dword [esp + 0xc0]
push edx
push eax
push ebx
call fcn.0043d0c0
mov eax, dword [esp + 0x290]
mov ecx, dword [esi + 0x88]
lea edx, [ecx + eax + 4]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x38]
add esp, 0x20
cmp dword [esi + 0x1b4], 0
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edx
je 0x463b9b
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebx
call fcn.00445bd0
mov eax, dword [esp + 0x50]
mov ecx, dword [esi + 0x88]
mov edx, dword [esp + 0x280]
add esp, 0x10
cmp eax, dword [esi + 0x1f0]
jne 0x463c0f
cmp dword [esi + 0x1b4], 0
lea eax, [ecx + edx + 4]
mov ecx, dword [esp + 0x278]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
je 0x463bfb
mov eax, dword [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00445b80
add esp, 0xc
jmp 0x463f70
lea eax, [ecx + edx + 6]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x278]
mov dword [esp + 0x24], eax
lea eax, [edi + ecx]
mov dword [esp + 0xfc], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x84]
add eax, edi
cmp byte [0x4aa648], 0
push 0
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x28]
push 0xc20
je 0x463c6b
push 0
push ecx
push edx
push eax
push ebx
mov ecx, esi
call fcn.0045f790
jmp 0x463c77
push ecx
push edx
push eax
push ebx
call fcn.0045c4b0
add esp, 0x18
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
mov dword [esp + 0x190], ecx
mov ecx, dword [esi + 0x88]
lea edx, [ecx + eax]
mov dword [esp + 0x68], eax
mov dword [esp + 0x58], eax
lea eax, [edx + 0xc]
cmp eax, dword [esi + 0x154]
jle 0x463cb0
mov dword [esi + 0x154], eax
mov eax, dword [esp + 0x270]
mov ecx, dword [esp + 0x278]
lea edx, [edx + eax + 6]
xor eax, eax
add ecx, 0xfffffffd
cmp edx, ecx
setg al
mov edi, eax
test edi, edi
mov eax, dword [esp + 0x270]
je 0x463d4e
mov edx, dword [esi + 0x88]
lea eax, [edx + eax + 6]
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x84]
add eax, dword [esp + 0x54]
cmp byte [0x4aa648], 0
push 0
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x28]
push 0x8c20
je 0x463d2f
push 0
push ecx
push edx
push eax
push ebx
mov ecx, esi
call fcn.0045f790
jmp 0x463d3b
push ecx
push edx
push eax
push ebx
call fcn.0045c4b0
add esp, 0x18
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x270]
mov ecx, dword [esi + 0x88]
add eax, ecx
mov ecx, dword [esp + 0xfc]
lea edx, [eax + 6]
mov dword [esp + 0xac], edx
mov edx, dword [esp + 0x278]
add edx, 0xfffffffd
mov dword [esp + 0xb4], edx
mov edx, dword [esp + 0x190]
add edx, ecx
cmp byte [0x4aa648], 0
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb8], edx
je 0x463e23
mov ecx, dword [esp + 0x278]
add eax, 4
mov dword [esp + 0x1b0], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1b4], eax
lea eax, [ecx - 3]
cmp eax, ecx
mov dword [esp + 0x1b8], eax
jle 0x463dcd
mov dword [esp + 0x1b8], ecx
mov ecx, dword [esp + 0x18]
neg edi
push 0
sbb edi, edi
and edi, 0x8000
or edi, 0x820
push edi
lea edx, [esp + 0x1b8]
push edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x1c8], ecx
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0xb8]
push eax
push ecx
push edx
push ebx
mov ecx, esi
call fcn.0045f790
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0x58]
add ecx, eax
mov dword [esp + 0xb4], ecx
jmp 0x463e65
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x64]
neg edi
sbb edi, edi
push 0
and edi, 0x8000
or edi, 0x820
push edi
lea edx, [esp + 0xb4]
push edx
push eax
push ecx
push ebx
call fcn.0045c4b0
mov edx, dword [esp + 0xc4]
mov eax, dword [esp + 0x70]
add esp, 0x18
add eax, edx
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0x270]
mov eax, dword [esi + 0x88]
lea edx, [eax + ecx + 4]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x68]
add eax, edx
lea eax, [eax + ecx + 0xc]
mov ecx, dword [esp + 0x278]
cmp eax, ecx
mov dword [esp + 0x2c], eax
jle 0x463e97
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x18]
push edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xb0]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
call fcn.00445bd0
mov edi, dword [esp + 0x50]
add esp, 0x10
cmp edi, dword [esi + 0x1ec]
jne 0x463efa
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 0x1e4]
jne 0x463efa
imul edi, dword [esp + 0x14]
push edi
mov ecx, esi
call fcn.004600f0
push eax
push 0
lea edx, [esp + 0x30]
push edx
push ebx
call fcn.00442490
add esp, 0x14
mov eax, dword [esi + 0x88]
add eax, dword [esp + 0x68]
cmp dword [esi + 0x1b4], 0
mov ecx, dword [esp + 0x270]
lea edx, [eax + ecx + 0xc]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x278]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
je 0x463f3f
mov eax, dword [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00445b80
mov ecx, dword [esp + 0xac]
add esp, 0xc
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [esp + 0x9c]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edi, dword [esp + 0x54]
cmp dword [esp + 0x150], 0
je 0x46402d
mov ecx, dword [esp + 0x280]
mov eax, dword [esp + 0x288]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x210], ecx
lea ecx, [esp + 0x210]
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x21c], edi
mov dword [esp + 0x224], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46402d
cmp byte [0x4aa648], 0
je 0x463fde
mov ecx, esi
call fcn.00473510
test eax, eax
je 0x463fde
mov edx, 1
jmp 0x463fe0
xor edx, edx
mov eax, dword [esi + 0x1b4]
cmp eax, 1
mov ecx, dword [esp + 0x48]
je 0x4640b2
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0xa8]
push 0
push edx
mov edx, dword [esp + 0x98]
push edx
mov edx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x28]
push edx
push edi
lea edx, [esp + 0x29c]
push edx
push 1
push ecx
push eax
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x154], 0
je 0x464116
mov ecx, dword [esp + 0x290]
mov eax, dword [esp + 0x298]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x1c0], ecx
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x1c8], eax
mov eax, dword [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x1cc], edi
mov dword [esp + 0x1d4], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x464116
test byte [esp + 0x12c], 1
je 0x4640bb
mov edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x40]
push eax
push ecx
push edx
call fcn.004758f0
add esp, 0x10
jmp 0x4640d2
mov eax, dword [esp + 0x34]
jmp 0x463ffb
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push 0x493d7a
push eax
push ecx
call fcn.00431500
add esp, 0xc
mov ecx, dword [esi + 0x1b4]
cmp ecx, 2
mov edx, dword [esp + 0x48]
je 0x464298
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 1
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x2ac]
push eax
push 2
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x158], 0
je 0x4641c3
mov ecx, dword [esp + 0x2a0]
mov eax, dword [esp + 0x2a8]
sub eax, ecx
lea edx, [esp + 0x250]
add eax, ecx
mov dword [esp + 0x250], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x25c], edi
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4641c3
mov eax, dword [esi + 0x1b4]
cmp eax, 3
mov ecx, dword [esp + 0x48]
je 0x4642a1
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0xe4]
push 0
push 0
push edx
mov edx, dword [esp + 0xf4]
push edx
mov edx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x28]
push edx
push edi
lea edx, [esp + 0x2bc]
push edx
push 3
push ecx
push eax
push ebx
mov ecx, esi
call fcn.0045fcc0
lea ecx, [esp + 0xe4]
call fcn.004768d0
cmp dword [esp + 0x15c], 0
je 0x4642fb
mov ecx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x2b8]
sub eax, ecx
add eax, ecx
mov dword [esp + 0x1e0], ecx
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x1e8], eax
mov eax, dword [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x1ec], edi
mov dword [esp + 0x1f4], eax
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4642fb
mov ecx, dword [esp + 0xf4]
test ecx, ecx
je 0x4642aa
mov eax, dword [esi + 0x1b4]
cmp eax, 4
mov edx, dword [esp + 0x48]
je 0x46423c
mov edx, dword [esp + 0x44]
cmp eax, 4
mov dword [esp + 0x68], edx
mov edx, dword [esp + 0x34]
je 0x46424d
mov edx, dword [esp + 0x20]
cmp byte [ecx], 0
mov eax, ecx
je 0x46425c
add eax, 1
cmp byte [eax], 0
jne 0x464254
push 0
push 0
sub eax, ecx
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x80]
push edi
lea eax, [esp + 0x2cc]
push eax
push 4
push ecx
push edx
push ebx
mov ecx, esi
call fcn.0045fcc0
lea ecx, [esp + 0xf0]
call fcn.004768d0
jmp 0x4642fb
mov ecx, dword [esp + 0x34]
jmp 0x4640ed
mov eax, dword [esp + 0x34]
jmp 0x464184
cmp dword [esi + 0x1b4], 4
mov eax, dword [esp + 0x34]
je 0x4642bb
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x2b0]
mov ecx, dword [esp + 0x2b8]
push eax
lea eax, [esp + 0x264]
mov dword [esp + 0x264], edx
mov edx, dword [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x270], edi
mov dword [esp + 0x274], ecx
mov dword [esp + 0x278], edx
call fcn.00445b80
add esp, 0xc
cmp dword [esp + 0x164], 0
je 0x4643db
mov ecx, dword [esp + 0x2d0]
mov eax, dword [esp + 0x2d8]
sub eax, ecx
lea edx, [esp + 0x200]
add eax, ecx
mov dword [esp + 0x200], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x20c], edi
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4643db
test byte [esp + 0x12c], 2
je 0x464380
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push eax
call fcn.00475460
add esp, 0x10
jmp 0x464397
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push 0x493d7a
push ecx
push edx
call fcn.00431500
add esp, 0xc
mov ecx, dword [esi + 0x1b4]
cmp ecx, 6
mov edx, dword [esp + 0x48]
je 0x464460
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x2ec]
push eax
push 6
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x168], 0
je 0x4644c4
mov ecx, dword [esp + 0x2e0]
mov eax, dword [esp + 0x2e8]
sub eax, ecx
lea edx, [esp + 0x240]
add eax, ecx
mov dword [esp + 0x240], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x24c], edi
mov dword [esp + 0x250], eax
mov dword [esp + 0x254], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4644c4
test byte [esp + 0x12c], 4
je 0x464469
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push eax
call fcn.00475460
add esp, 0x10
jmp 0x464480
mov ecx, dword [esp + 0x34]
jmp 0x4643b2
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push 0x493d7a
push ecx
push edx
call fcn.00431500
add esp, 0xc
mov ecx, dword [esi + 0x1b4]
cmp ecx, 7
mov edx, dword [esp + 0x48]
je 0x464549
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x2fc]
push eax
push 7
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x160], 0
je 0x4645ad
mov ecx, dword [esp + 0x2c0]
mov eax, dword [esp + 0x2c8]
sub eax, ecx
lea edx, [esp + 0x220]
add eax, ecx
mov dword [esp + 0x220], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x22c], edi
mov dword [esp + 0x230], eax
mov dword [esp + 0x234], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4645ad
test byte [esp + 0x12c], 8
je 0x464552
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x120]
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x40]
push ecx
push edx
push eax
call fcn.00475460
add esp, 0x10
jmp 0x464569
mov ecx, dword [esp + 0x34]
jmp 0x46449b
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push 0x493d7a
push ecx
push edx
call fcn.00431500
add esp, 0xc
mov ecx, dword [esi + 0x1b4]
cmp ecx, 5
mov edx, dword [esp + 0x48]
je 0x464627
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x2dc]
push eax
push 5
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x16c], 0
je 0x46468b
mov ecx, dword [esp + 0x2f0]
mov eax, dword [esp + 0x2f8]
sub eax, ecx
mov dword [esp + 0x1d0], ecx
add ecx, eax
lea edx, [esp + 0x1d0]
mov dword [esp + 0x1d8], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x1dc], edi
mov dword [esp + 0x1e4], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x46468b
test byte [esp + 0x12c], 0x10
je 0x464630
mov eax, dword [esp + 0x128]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push eax
push ecx
push edx
call fcn.0044dbf0
jmp 0x464644
mov ecx, dword [esp + 0x34]
jmp 0x464584
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push 0x493d7a
push eax
push ecx
call fcn.00431500
mov ecx, dword [esi + 0x1b4]
mov edx, dword [esp + 0x54]
add esp, 0xc
cmp ecx, 8
je 0x464769
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x30c]
push eax
push 8
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x170], 0
je 0x4647b8
mov ecx, dword [esp + 0x300]
mov eax, dword [esp + 0x308]
sub eax, ecx
mov dword [esp + 0x1f0], ecx
add ecx, eax
lea edx, [esp + 0x1f0]
mov dword [esp + 0x1f8], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x1fc], edi
mov dword [esp + 0x204], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4647b8
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x1a0]
push ecx
mov ecx, dword [esp + 0x7c]
lea edx, [esp + 0x194]
push edx
mov edx, dword [esp + 0xa0]
lea eax, [esp + 0x1ac]
push eax
push ecx
push edx
call fcn.00403690
mov eax, dword [esp + 0x1bc]
mov ecx, dword [esp + 0x1b4]
mov edx, dword [esp + 0x1a4]
add esp, 0x18
push eax
mov eax, dword [esp + 0x1a4]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push eax
push ecx
mov ecx, esi
call fcn.004734a0
push eax
call fcn.00430330
add esp, 0x14
test eax, eax
je 0x464772
mov eax, dword [eax]
cdq
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push edx
push eax
call fcn.0044da40
add esp, 0x10
jmp 0x464774
mov ecx, dword [esp + 0x34]
jmp 0x464662
xor eax, eax
mov ecx, dword [esi + 0x1b4]
cmp ecx, 9
mov edx, dword [esp + 0x48]
je 0x4648a1
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 1
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x31c]
push eax
push 9
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
cmp dword [esp + 0x174], 0
je 0x4648f0
mov ecx, dword [esp + 0x310]
mov eax, dword [esp + 0x318]
sub eax, ecx
mov dword [esp + 0x130], ecx
add ecx, eax
lea edx, [esp + 0x130]
mov dword [esp + 0x138], ecx
mov ecx, dword [esp + 0x18]
push edx
push ebx
mov dword [esp + 0x13c], edi
mov dword [esp + 0x144], ecx
call dword [sym.imp.GDI32.dll_RectVisible]
test eax, eax
je 0x4648f0
lea eax, [esp + 0x194]
push eax
lea ecx, [esp + 0x19c]
push ecx
mov ecx, dword [esp + 0x7c]
lea edx, [esp + 0xe0]
push edx
mov edx, dword [esp + 0xa0]
lea eax, [esp + 0xdc]
push eax
push ecx
push edx
call fcn.00403690
mov ecx, dword [esp + 0x1ac]
mov edx, dword [esp + 0x1b0]
add esp, 0x18
lea eax, [esp + 0x17c]
push eax
mov eax, dword [esp + 0xdc]
push ecx
mov ecx, dword [esp + 0xd8]
push edx
mov edx, dword [esp + 0x4c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.004734a0
push eax
call fcn.00413300
add esp, 0x18
test eax, eax
je 0x4648aa
mov ecx, dword [eax + 5]
mov edx, dword [eax + 1]
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x40]
push edx
push eax
push ecx
call fcn.00475460
add esp, 0x10
jmp 0x4648ac
mov ecx, dword [esp + 0x34]
jmp 0x46478f
xor eax, eax
mov ecx, dword [esi + 0x1b4]
cmp ecx, 0xa
mov edx, dword [esp + 0x48]
je 0x4649c4
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
push 0
push 0
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x28]
push eax
push edi
lea eax, [esp + 0x32c]
push eax
push 0xa
push edx
push ecx
push ebx
mov ecx, esi
call fcn.0045fcc0
mov edx, dword [esp + 0x98]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
add ecx, edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
push edx
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
call fcn.00445b80
add esp, 0xc
cmp dword [0x4aa6f8], 0
je 0x464a3e
cmp dword [esi + 0x20c], 1
jne 0x4649fa
lea ecx, [esi + 0x144]
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, esi
call fcn.00460080
imul eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x90]
mov edi, dword [esp + 0x4c]
sub ecx, eax
sub ecx, edi
push ecx
mov ecx, esi
call fcn.004600f0
neg eax
push eax
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, esi
call fcn.0045ff70
test eax, eax
mov ecx, esi
je 0x4649cd
call fcn.00460080
imul eax, dword [esp + 0x14]
sub eax, edi
add eax, dword [esi + 0x90]
mov ecx, esi
push eax
call fcn.004600f0
push eax
push 0
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.00445d40
add esp, 0x14
jmp 0x4649fe
mov ecx, dword [esp + 0x34]
jmp 0x4648c7
call fcn.00460080
imul eax, dword [esp + 0x14]
sub eax, edi
add eax, dword [esi + 0x90]
mov ecx, esi
push eax
call fcn.004600f0
push eax
push 0
lea ecx, [esp + 0x30]
push ecx
push ebx
call fcn.00442490
add esp, 0x14
jmp 0x4649fe
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x70]
push 0xcc0020
push 0
push 0
push ebx
push edx
push eax
push edi
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [0x4aa6f8], 0
je 0x464a42
mov edx, dword [esp + 0x14]
neg edx
push edx
push 0
push ebx
call dword [sym.imp.GDI32.dll_OffsetClipRgn]
jmp 0x464a4a
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x54], eax
add edi, dword [esp + 0x14]
add dword [esp + 0x40], 1
cmp edi, dword [esp + 0xa8]
mov dword [esp + 0x4c], edi
jl 0x4635c0
cmp dword [0x4aa6f8], 0
je 0x464cc6
cmp dword [esi + 0x20c], 1
jne 0x464cc6
mov ecx, dword [esp + 0xa8]
cmp dword [esp + 0x4c], ecx
jge 0x464cc6
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x80]
mov ecx, dword [esp + 0x54]
add edx, eax
mov eax, dword [esp + 0x14]
add ecx, eax
neg eax
mov dword [esp + 0xd0], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0xd8], eax
lea ecx, [ecx]
xor ebp, ebp
lea edi, [esp + 0x278]
lea esp, [esp]
cmp dword [esp + ebp*4 + 0x14c], 0
je 0x464b16
cmp dword [esi + 0x1b4], ebp
mov edx, dword [edi - 8]
mov eax, dword [esp + 0x54]
mov ecx, dword [edi]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
je 0x464b07
mov eax, dword [esp + 0x5c]
push eax
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.00445b80
add esp, 0xc
add ebp, 1
add edi, 0x10
cmp ebp, 0xb
jl 0x464ad0
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0xd0]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x2c], eax
push edx
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
push eax
push ebx
mov dword [esp + 0x3c], ecx
call fcn.00445b80
add esp, 0xc
lea eax, [esi + 0x144]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov edx, dword [esi + 0x1e4]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100000
jne 0x464b86
xor ebp, ebp
jmp 0x464bed
mov ecx, dword [esi + 0x1e4]
xor eax, eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
lea eax, [esp + 0x130]
push eax
push 0
push ecx
mov dword [esp + 0x13c], 0x1c
mov dword [esp + 0x140], 4
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov ebp, dword [esp + 0x144]
mov ecx, esi
call fcn.00460080
imul eax, dword [esp + 0x14]
mov edx, dword [esi + 0x90]
mov edi, dword [esp + 0x4c]
sub edx, eax
sub edx, edi
push edx
neg ebp
push ebp
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, esi
call fcn.0045ff70
test eax, eax
mov ecx, esi
je 0x464c4f
call fcn.00460080
mov ebp, dword [esp + 0x14]
imul eax, ebp
sub eax, edi
add eax, dword [esi + 0x90]
mov ecx, esi
push eax
call fcn.004600f0
push eax
push 0
lea ecx, [esp + 0x30]
push ecx
push ebx
call fcn.00445d40
jmp 0x464c7b
call fcn.00460080
imul eax, dword [esp + 0x14]
sub eax, edi
add eax, dword [esi + 0x90]
mov ecx, esi
push eax
call fcn.004600f0
push eax
push 0
lea edx, [esp + 0x30]
push edx
push ebx
call fcn.00442490
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x84]
add esp, 0x14
push 0xcc0020
push 0
push 0
push ebx
push ebp
push eax
push edi
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0xd8]
push edx
push 0
push ebx
call dword [sym.imp.GDI32.dll_OffsetClipRgn]
add edi, ebp
cmp edi, dword [esp + 0xa8]
mov dword [esp + 0x4c], edi
jl 0x464ac0
mov eax, dword [esp + 0x1ac]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
call fcn.0043d250
call fcn.00438300
lea ecx, [esp + 0x90]
mov byte [esp + 0x328], 5
call fcn.00476730
lea ecx, [esp + 0x38]
mov byte [esp + 0x328], 4
call fcn.00476730
lea ecx, [esp + 0x60]
mov byte [esp + 0x328], 3
call fcn.00476730
lea ecx, [esp + 0x88]
mov byte [esp + 0x328], 2
call fcn.00476730
cmp dword [0x4aa6f8], 0
je 0x464d51
mov ecx, dword [esp + 0x1a8]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x184]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x464d5a
push 0
push ebx
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov edi, dword [esp + 0xf8]
mov ebp, dword [esp + 0x4c]
cmp dword [0x4aa6f8], 0
je 0x464d7b
cmp dword [esi + 0x20c], 1
je 0x464ec9
xor eax, eax
lea ecx, [esp + 0x27c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x58], ecx
lea esp, [esp]
cmp dword [esp + eax*4 + 0x14c], 0
je 0x464dd0
cmp dword [esi + 0x1b4], eax
mov eax, dword [esp + 0x78]
lea edx, [edi + ebp]
mov dword [ecx - 8], ebp
mov dword [ecx], edx
je 0x464db2
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x70]
push eax
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff4
push eax
push ecx
call fcn.00445b80
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x28]
add esp, 0xc
add eax, 1
add ecx, 0x10
cmp eax, 0xb
mov dword [esp + 0x1c], eax
mov dword [esp + 0x58], ecx
jl 0x464d90
mov eax, dword [esi + 0x1e4]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x98]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x5c]
add ecx, edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x34], ebp
call fcn.00445b80
add esp, 0xc
cmp dword [esi + 0x20c], 1
jne 0x464ec9
lea eax, [esi + 0x144]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, esi
call fcn.00460080
mov edi, dword [esp + 0x14]
mov edx, dword [esi + 0x90]
imul eax, edi
sub edx, eax
push edx
mov ecx, esi
call fcn.004600f0
neg eax
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov ecx, esi
call fcn.0045ff70
test eax, eax
mov ecx, esi
je 0x464ea2
call fcn.00460080
imul eax, edi
add eax, dword [esi + 0x90]
mov ecx, esi
push eax
call fcn.004600f0
push eax
push 0
lea ecx, [esp + 0x30]
push ecx
push ebx
call fcn.00445d40
jmp 0x464ec6
call fcn.00460080
imul eax, edi
add eax, dword [esi + 0x90]
mov ecx, esi
push eax
call fcn.004600f0
push eax
push 0
lea edx, [esp + 0x30]
push edx
push ebx
call fcn.00442490
add esp, 0x14
mov eax, dword [esp + 0xe0]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0xc8]
push edx
call esi
mov eax, dword [esp + 0xbc]
push eax
call esi
mov ecx, dword [esp + 0xc4]
push ecx
call esi
mov edx, dword [esp + 0xcc]
push edx
call esi
mov eax, dword [esp + 0x78]
push eax
call esi
mov ecx, dword [esp + 0x5c]
push ecx
call esi
cmp dword [0x4aa6f8], 0
je 0x464f26
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x17c]
mov byte [esp + 0x328], 1
call fcn.00476730
lea ecx, [esp + 0xf0]
mov byte [esp + 0x328], 0
call fcn.00476730
lea ecx, [esp + 0xe4]
mov dword [esp + 0x328], 0xffffffff
call fcn.00476730
mov ecx, dword [esp + 0x320]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x31c
ret 8